{"items":[{"type":"link","label":"Connector API","link":"/api-reference/connectors","routeSlug":"/api-reference/connectors","content":{"contentType":"overview","meta":{"name":"Connector API"},"children":[{"nodeType":"container","panels":[{"title":"Download OpenAPI description","titleTranslationKey":"download.description.title","children":[{"kind":"download","label":"connectors.json","url":"/_bundle/api-reference/connectors.json?download"},{"kind":"download","label":"connectors.yaml","url":"/_bundle/api-reference/connectors.yaml?download"}]},{"title":"Overview","titleTranslationKey":"info.title","children":[]},{"title":"Languages","titleTranslationKey":"languages.title","children":[{"kind":"languages","options":[{"key":"curl","title":"curl","lang":"curl"}]}]},{"title":"Servers","titleTranslationKey":"servers.title","children":[{"kind":"servers","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"mode":"default"}]}],"children":[{"nodeType":"overview-section-wrapper","children":[{"nodeType":"header","level":1,"label":"Connector API","showPageActions":true},{"nodeType":"overview-section-wrapper","children":[{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Synqly Connector APIs provide a unifying interface and data model for all supported service Providers."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"/guides/getting-started/overview"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Synqly Overview"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for more information."},"children":[],"type":"text"}],"type":"paragraph"}]}],"sectionId":"/"}],"sectionId":"/"}]}]}},{"type":"group","label":"Application Security (Pre-Release)","link":"/api-reference/connectors/appsec","routeSlug":"/api-reference/connectors/appsec","items":[{"label":"Query Applications","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/appsec/appsec_query_applications","routeSlug":"/api-reference/connectors/appsec/appsec_query_applications","metadata":{"seo":{"title":"Query Applications","description":"This operation is available for testing but may be unstable. Breakingchanges are unlikely but may still be necessary.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"appsec_query_applications","name":"Query Applications","isWebhook":false,"pointer":"/paths/~1v1~1app-sec~1applications/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Applications","badges":[{"name":"Beta","color":"pre-release","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"info","name":"Pre-Release"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is available for testing but may be unstable. Breaking"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"changes are unlikely but may still be necessary."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of applications matching the query from a the token-linked application security integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"appsec_query_applications"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of applications to return. Defaults to 100 with a maximum of 5000. If a provider has a maximum limit lower than 5000, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/appsec/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1app-sec~1applications/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/app-sec/applications","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/app-sec/applications","href":"appsec/appsec_query_applications","openApiOperationId":"appsec_query_applications","summary":"Query Applications"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/AppSecQueryApplicationsResponse"}},"schemaId":"components/schemas/AppSecQueryApplicationsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1app-sec~1applications/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/AppSecQueryApplicationsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/AppSecQueryApplicationsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/appsec/appsec_query_applications"}],"panels":[]}]},"badges":[{"name":"Beta","color":"pre-release","position":"before"}],"httpPath":"/v1/app-sec/applications"},{"label":"Query Application Findings","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/appsec/appsec_query_application_findings","routeSlug":"/api-reference/connectors/appsec/appsec_query_application_findings","metadata":{"seo":{"title":"Query Application Findings","description":"This operation is available for testing but may be unstable. Breakingchanges are unlikely but may still be necessary.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"appsec_query_application_findings","name":"Query Application Findings","isWebhook":false,"pointer":"/paths/~1v1~1app-sec~1applications~1{applicationId}~1findings/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Application Findings","badges":[{"name":"Beta","color":"pre-release","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"info","name":"Pre-Release"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is available for testing but may be unstable. Breaking"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"changes are unlikely but may still be necessary."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of an application's findings matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{applictionId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and the query from a the token-linked application security integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"appsec_query_application_findings"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"applicationId","in":"path","schemaId":"schema_4","required":true}],"pointer":"/paths/~1v1~1app-sec~1applications~1{applicationId}~1findings/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of findings to return. Defaults to 100 with a maximum of 5000. If a provider has a maximum limit lower than 5000, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/appsec/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1app-sec~1applications~1{applicationId}~1findings/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/app-sec/applications/{applicationId}/findings","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"applicationId","in":"path","required":true,"schemaId":"schema_5"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/app-sec/applications/{applicationId}/findings","href":"appsec/appsec_query_application_findings","openApiOperationId":"appsec_query_application_findings","summary":"Query Application Findings"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/AppSecQueryApplicationFindingsResponse"}},"schemaId":"components/schemas/AppSecQueryApplicationFindingsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1app-sec~1applications~1{applicationId}~1findings/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/AppSecQueryApplicationFindingsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/AppSecQueryApplicationFindingsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/appsec/appsec_query_application_findings"}],"panels":[]}]},"badges":[{"name":"Beta","color":"pre-release","position":"before"}],"httpPath":"/v1/app-sec/applications/{applicationId}/findings"},{"label":"Query findings across all applications","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/appsec/appsec_query_findings","routeSlug":"/api-reference/connectors/appsec/appsec_query_findings","metadata":{"seo":{"title":"Query findings across all applications","description":"This operation is available for testing but may be unstable. Breakingchanges are unlikely but may still be necessary.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"appsec_query_findings","name":"Query findings across all applications","isWebhook":false,"pointer":"/paths/~1v1~1app-sec~1findings/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query findings across all applications","badges":[{"name":"Beta","color":"pre-release","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"info","name":"Pre-Release"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is available for testing but may be unstable. Breaking"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"changes are unlikely but may still be necessary."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of each findings details combined with the application details for all applications in the token-linked application security integration. This API may perform multiple provider API calls per executation so can be slower to respond."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"appsec_query_findings"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of findings to return. Defaults to 100 with a maximum of 5000. If a provider has a maximum limit lower than 5000, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/appsec/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1app-sec~1findings/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/app-sec/findings","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/app-sec/findings","href":"appsec/appsec_query_findings","openApiOperationId":"appsec_query_findings","summary":"Query findings across all applications"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/AppSecQueryFindingsResponse"}},"schemaId":"components/schemas/AppSecQueryFindingsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1app-sec~1findings/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/AppSecQueryFindingsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/AppSecQueryFindingsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/appsec/appsec_query_findings"}],"panels":[]}]},"badges":[{"name":"Beta","color":"pre-release","position":"before"}],"httpPath":"/v1/app-sec/findings"},{"label":"Create Findings","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/appsec/appsec_create_findings","routeSlug":"/api-reference/connectors/appsec/appsec_create_findings","metadata":{"seo":{"title":"Create Findings","description":"This operation is available for testing but may be unstable. Breakingchanges are unlikely but may still be necessary.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"appsec_create_findings","name":"Create Findings","isWebhook":false,"pointer":"/paths/~1v1~1app-sec~1findings~1bulk/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Create Findings","badges":[{"name":"Beta","color":"pre-release","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"info","name":"Pre-Release"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is available for testing but may be unstable. Breaking"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"changes are unlikely but may still be necessary."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Create application security posture findings (bulk) in an application security provider."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"appsec_create_findings"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1app-sec~1findings~1bulk/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_6"}},"schemaId":"schema_6","pointer":"/paths/~1v1~1app-sec~1findings~1bulk/post/requestBody","description":"Application security posture findings to create."}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/app-sec/findings/bulk","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"schema_6"}},"responseCodes":["202","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/app-sec/findings/bulk","href":"appsec/appsec_create_findings","openApiOperationId":"appsec_create_findings","summary":"Create Findings"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"schema_6","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_6"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"202","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/AppSecCreateFindingsResponse"}},"schemaId":"components/schemas/AppSecCreateFindingsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1app-sec~1findings~1bulk/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"202","schemaId":"components/schemas/AppSecCreateFindingsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/AppSecCreateFindingsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/appsec/appsec_create_findings"}],"panels":[]}]},"badges":[{"name":"Beta","color":"pre-release","position":"before"}],"httpPath":"/v1/app-sec/findings/bulk"},{"label":"Get Application Finding Details","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/appsec/appsec_get_application_finding_details","routeSlug":"/api-reference/connectors/appsec/appsec_get_application_finding_details","metadata":{"seo":{"title":"Get Application Finding Details","description":"This operation is available for testing but may be unstable. Breakingchanges are unlikely but may still be necessary.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"appsec_get_application_finding_details","name":"Get Application Finding Details","isWebhook":false,"pointer":"/paths/~1v1~1app-sec~1applications~1{applicationId}~1findings~1{findingId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Application Finding Details","badges":[{"name":"Beta","color":"pre-release","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"info","name":"Pre-Release"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is available for testing but may be unstable. Breaking"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"changes are unlikely but may still be necessary."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the details of the finding matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{findingId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" where the finding belongs to the application matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{applicationId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from the token-linked application security integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"appsec_get_application_finding_details"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"applicationId","in":"path","schemaId":"schema_4","required":true},{"name":"findingId","in":"path","schemaId":"schema_7","required":true}],"pointer":"/paths/~1v1~1app-sec~1applications~1{applicationId}~1findings~1{findingId}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1app-sec~1applications~1{applicationId}~1findings~1{findingId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/app-sec/applications/{applicationId}/findings/{findingId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"applicationId","in":"path","required":true,"schemaId":"schema_5"},{"name":"findingId","in":"path","required":true,"schemaId":"schema_8"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/app-sec/applications/{applicationId}/findings/{findingId}","href":"appsec/appsec_get_application_finding_details","openApiOperationId":"appsec_get_application_finding_details","summary":"Get Application Finding Details"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/AppSecGetApplicationFindingDetailsResponse"}},"schemaId":"components/schemas/AppSecGetApplicationFindingDetailsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1app-sec~1applications~1{applicationId}~1findings~1{findingId}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/AppSecGetApplicationFindingDetailsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/AppSecGetApplicationFindingDetailsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/appsec/appsec_get_application_finding_details"}],"panels":[]}]},"badges":[{"name":"Beta","color":"pre-release","position":"before"}],"httpPath":"/v1/app-sec/applications/{applicationId}/findings/{findingId}"},{"label":"Query Application Scans","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/appsec/appsec_query_application_scans","routeSlug":"/api-reference/connectors/appsec/appsec_query_application_scans","metadata":{"seo":{"title":"Query Application Scans","description":"This operation is available for testing but may be unstable. Breakingchanges are unlikely but may still be necessary.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"appsec_query_application_scans","name":"Query Application Scans","isWebhook":false,"pointer":"/paths/~1v1~1app-sec~1applications~1{applicationId}~1scans/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Application Scans","badges":[{"name":"Beta","color":"pre-release","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"info","name":"Pre-Release"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is available for testing but may be unstable. Breaking"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"changes are unlikely but may still be necessary."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of scan activity records for the application matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{applicationId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from the token-linked application security integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"appsec_query_application_scans"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"applicationId","in":"path","schemaId":"schema_4","required":true}],"pointer":"/paths/~1v1~1app-sec~1applications~1{applicationId}~1scans/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of scan records to return. Defaults to 100 with a maximum of 5000. If a provider has a maximum limit lower than 5000, the provider's maximum limit will be used instead."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1app-sec~1applications~1{applicationId}~1scans/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/app-sec/applications/{applicationId}/scans","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"applicationId","in":"path","required":true,"schemaId":"schema_5"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/app-sec/applications/{applicationId}/scans","href":"appsec/appsec_query_application_scans","openApiOperationId":"appsec_query_application_scans","summary":"Query Application Scans"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/AppSecQueryApplicationScansResponse"}},"schemaId":"components/schemas/AppSecQueryApplicationScansResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1app-sec~1applications~1{applicationId}~1scans/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/AppSecQueryApplicationScansResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/AppSecQueryApplicationScansResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/appsec/appsec_query_application_scans"}],"panels":[]}]},"badges":[{"name":"Beta","color":"pre-release","position":"before"}],"httpPath":"/v1/app-sec/applications/{applicationId}/scans"}],"content":{"contentType":"group","meta":{"name":"Appsec"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Application Security (Pre-Release)","showPageActions":true},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"info","name":"Pre-Release"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This feature is available for testing but may be unstable. Breaking"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"changes are unlikely but may still be necessary."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this feature."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"}]}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/app-sec/applications","summary":"Query Applications","prefix":{"name":"get","color":"get"},"badges":[{"name":"Beta","color":"pre-release","position":"before"}],"link":"/appsec/appsec_query_applications","deprecated":false},{"title":"/v1/app-sec/applications/{applicationId}/findings","summary":"Query Application Findings","prefix":{"name":"get","color":"get"},"badges":[{"name":"Beta","color":"pre-release","position":"before"}],"link":"/appsec/appsec_query_application_findings","deprecated":false},{"title":"/v1/app-sec/findings","summary":"Query findings across all applications","prefix":{"name":"get","color":"get"},"badges":[{"name":"Beta","color":"pre-release","position":"before"}],"link":"/appsec/appsec_query_findings","deprecated":false},{"title":"/v1/app-sec/findings/bulk","summary":"Create Findings","prefix":{"name":"post","color":"post"},"badges":[{"name":"Beta","color":"pre-release","position":"before"}],"link":"/appsec/appsec_create_findings","deprecated":false},{"title":"/v1/app-sec/applications/{applicationId}/findings/{findingId}","summary":"Get Application Finding Details","prefix":{"name":"get","color":"get"},"badges":[{"name":"Beta","color":"pre-release","position":"before"}],"link":"/appsec/appsec_get_application_finding_details","deprecated":false},{"title":"/v1/app-sec/applications/{applicationId}/scans","summary":"Query Application Scans","prefix":{"name":"get","color":"get"},"badges":[{"name":"Beta","color":"pre-release","position":"before"}],"link":"/appsec/appsec_query_application_scans","deprecated":false}]}]}]}]}},{"type":"group","label":"Assets","link":"/api-reference/connectors/assets","routeSlug":"/api-reference/connectors/assets","items":[{"label":"Query Devices","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/assets/assets_query_devices","routeSlug":"/api-reference/connectors/assets/assets_query_devices","metadata":{"seo":{"title":"Query Devices","description":"Query devices from an asset inventory system"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"assets_query_devices","name":"Query Devices","isWebhook":false,"pointer":"/paths/~1v1~1assets~1devices/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Devices","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Query devices from an asset inventory system"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"assets_query_devices"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of finding reports to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/assets/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"order","in":"query","schemaId":"schema_2","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1assets~1devices/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/assets/devices","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"order","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/assets/devices","href":"assets/assets_query_devices","openApiOperationId":"assets_query_devices","summary":"Query Devices"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryDevicesResponse"}},"schemaId":"components/schemas/QueryDevicesResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1assets~1devices/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryDevicesResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryDevicesResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/assets/assets_query_devices"}],"panels":[]}]},"httpPath":"/v1/assets/devices"},{"label":"Create Device","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/assets/assets_create_asset","routeSlug":"/api-reference/connectors/assets/assets_create_asset","metadata":{"seo":{"title":"Create Device","description":"Creates a Device object in the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"assets_create_asset","name":"Create Device","isWebhook":false,"pointer":"/paths/~1v1~1assets~1devices/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Create Device","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Creates a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Device"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object in the token-linked Integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"assets_create_asset"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1assets~1devices/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateDeviceRequest"}},"schemaId":"components/schemas/CreateDeviceRequest","pointer":"/paths/~1v1~1assets~1devices/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/assets/devices","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/CreateDeviceRequest"}},"responseCodes":["200","400","401","402","403","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/assets/devices","href":"assets/assets_create_asset","openApiOperationId":"assets_create_asset","summary":"Create Device"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/CreateDeviceRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateDeviceRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateDeviceResponse"}},"schemaId":"components/schemas/CreateDeviceResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1assets~1devices/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/CreateDeviceResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateDeviceResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/assets/assets_create_asset"}],"panels":[]}]},"httpPath":"/v1/assets/devices"},{"label":"Create Devices","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/assets/assets_create_devices","routeSlug":"/api-reference/connectors/assets/assets_create_devices","metadata":{"seo":{"title":"Create Devices","description":"Bulk create devices in an device inventory system"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"assets_create_devices","name":"Create Devices","isWebhook":false,"pointer":"/paths/~1v1~1assets~1devices~1bulk/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Create Devices","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Bulk create devices in an device inventory system"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"assets_create_devices"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1assets~1devices~1bulk/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateDevicesRequest"}},"schemaId":"components/schemas/CreateDevicesRequest","pointer":"/paths/~1v1~1assets~1devices~1bulk/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/assets/devices/bulk","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/CreateDevicesRequest"}},"responseCodes":["200","400","401","402","403","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/assets/devices/bulk","href":"assets/assets_create_devices","openApiOperationId":"assets_create_devices","summary":"Create Devices"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/CreateDevicesRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateDevicesRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateDevicesResponse"}},"schemaId":"components/schemas/CreateDevicesResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1assets~1devices~1bulk/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/CreateDevicesResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateDevicesResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/assets/assets_create_devices"}],"panels":[]}]},"httpPath":"/v1/assets/devices/bulk"},{"label":"Get Labels","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/assets/assets_get_labels","routeSlug":"/api-reference/connectors/assets/assets_get_labels","metadata":{"seo":{"title":"Get Labels","description":"Get labels from an asset inventory system"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"assets_get_labels","name":"Get Labels","isWebhook":false,"pointer":"/paths/~1v1~1assets~1labels/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Labels","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Get labels from an asset inventory system"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"assets_get_labels"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1assets~1labels/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/assets/labels","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400"],"pointer":"/v1/assets/labels","href":"assets/assets_get_labels","openApiOperationId":"assets_get_labels","summary":"Get Labels"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetLabelsResponse"}},"schemaId":"components/schemas/GetLabelsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1assets~1labels/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetLabelsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetLabelsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/assets/assets_get_labels"}],"panels":[]}]},"httpPath":"/v1/assets/labels"},{"label":"Query Software Inventory","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/assets/assets_query_software","routeSlug":"/api-reference/connectors/assets/assets_query_software","metadata":{"seo":{"title":"Query Software Inventory","description":"Query software inventory records from an asset management system"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"assets_query_software","name":"Query Software Inventory","isWebhook":false,"pointer":"/paths/~1v1~1assets~1software/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Software Inventory","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Query software inventory records from an asset management system"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"assets_query_software"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of software inventory records to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/assets/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Assets Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"order","in":"query","schemaId":"schema_2","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"package.name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"package.name[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by package name in ascending order."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1assets~1software/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/assets/software","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"order","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/assets/software","href":"assets/assets_query_software","openApiOperationId":"assets_query_software","summary":"Query Software Inventory"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QuerySoftwareInventoryResponse"}},"schemaId":"components/schemas/QuerySoftwareInventoryResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1assets~1software/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QuerySoftwareInventoryResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QuerySoftwareInventoryResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/assets/assets_query_software"}],"panels":[]}]},"httpPath":"/v1/assets/software"},{"label":"Create Software Inventory","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/assets/assets_create_software","routeSlug":"/api-reference/connectors/assets/assets_create_software","metadata":{"seo":{"title":"Create Software Inventory","description":"Creates a software inventory record in the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"assets_create_software","name":"Create Software Inventory","isWebhook":false,"pointer":"/paths/~1v1~1assets~1software/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Create Software Inventory","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Creates a software inventory record in the token-linked Integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Tenable Cloud:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" This is asset import enrichment, not full software-inventory CRUD. Each"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"request pushes one CPE onto an asset via Tenable "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"POST /import/assets"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"installed_software"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"CPE 2.2 strings). The call blocks on the same asynchronous Tenable import job poll before"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"returning (typically seconds, up to the request deadline; may return gateway timeout if the"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"job does not complete in time). "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"query_software"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" reads from asset export and may lag briefly"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"after a successful create."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"When to use create:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" First push or enrichment when you may only have hostname, IP, MAC, or"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"cloud instance identifiers. Use "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"update"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" when you already have "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"device.uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and want to"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"refresh software on a known asset."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Provide "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"package.cpe_name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" when possible; Synqly can synthesize"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpe:/a:vendor:name:version"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"package.name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"package.vendor_name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", and"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"package.version"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", but weak CPEs may not correlate in Tenable. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"device.uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (Tenable asset"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"UUID) is optional; hostname, IP, MAC, or cloud instance identifiers also work for asset"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"matching. Only one package CPE is sent per request. Software is merged additively per"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"source_name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" — entries from other sources are unaffected. This does not replace full"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"inventory, delete packages, or trigger vulnerability scans. Imported software expires if"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"not re-imported within Tenable's retention window (approximately 30 days)."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"assets_create_software"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1assets~1software/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateSoftwareInventoryRequest"}},"schemaId":"components/schemas/CreateSoftwareInventoryRequest","pointer":"/paths/~1v1~1assets~1software/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/assets/software","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/CreateSoftwareInventoryRequest"}},"responseCodes":["200","400","401","402","403","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/assets/software","href":"assets/assets_create_software","openApiOperationId":"assets_create_software","summary":"Create Software Inventory"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/CreateSoftwareInventoryRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateSoftwareInventoryRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateSoftwareInventoryResponse"}},"schemaId":"components/schemas/CreateSoftwareInventoryResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1assets~1software/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/CreateSoftwareInventoryResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateSoftwareInventoryResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/assets/assets_create_software"}],"panels":[]}]},"httpPath":"/v1/assets/software"},{"label":"Query Device Software Inventory","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/assets/assets_query_device_software","routeSlug":"/api-reference/connectors/assets/assets_query_device_software","metadata":{"seo":{"title":"Query Device Software Inventory","description":"Query software inventory records for a single device."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"assets_query_device_software","name":"Query Device Software Inventory","isWebhook":false,"pointer":"/paths/~1v1~1assets~1devices~1{deviceUid}~1software/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Device Software Inventory","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Query software inventory records for a single device."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"assets_query_device_software"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"deviceUid","in":"path","schemaId":"schema_9","description":"Uid of the device.","required":true}],"pointer":"/paths/~1v1~1assets~1devices~1{deviceUid}~1software/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of software inventory records to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/assets/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Assets Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"order","in":"query","schemaId":"schema_2","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Results are returned in a fixed "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"package.name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" ascending order. Passing "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"order"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is rejected."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1assets~1devices~1{deviceUid}~1software/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/assets/devices/{deviceUid}/software","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"deviceUid","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"order","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/assets/devices/{deviceUid}/software","href":"assets/assets_query_device_software","openApiOperationId":"assets_query_device_software","summary":"Query Device Software Inventory"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QuerySoftwareInventoryResponse"}},"schemaId":"components/schemas/QuerySoftwareInventoryResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1assets~1devices~1{deviceUid}~1software/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QuerySoftwareInventoryResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QuerySoftwareInventoryResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/assets/assets_query_device_software"}],"panels":[]}]},"httpPath":"/v1/assets/devices/{deviceUid}/software"},{"label":"Update Software Inventory","deprecated":false,"httpVerb":"put","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/assets/assets_update_software","routeSlug":"/api-reference/connectors/assets/assets_update_software","metadata":{"seo":{"title":"Update Software Inventory","description":"Updates a software inventory record on a known device in the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"assets_update_software","name":"Update Software Inventory","isWebhook":false,"pointer":"/paths/~1v1~1assets~1software~1{deviceUid}/put","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Update Software Inventory","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Updates a software inventory record on a known device in the token-linked Integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Tenable Cloud:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" This re-imports software on an existing asset; it is not in-place PATCH"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"or delete. Each request uses the same "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"POST /import/assets"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" path as create and blocks on"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"the same asynchronous Tenable import job poll before returning (typically seconds, up to"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"the request deadline; may return gateway timeout if the job does not complete in time)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"query_software"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" may lag briefly after a successful update. Bulk refresh should batch CPEs"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"via create/import flows rather than serial single-row updates."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"When to use update:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" You have "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"device.uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (path "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"deviceUid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") and want to refresh or"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"re-affirm a known CPE under a stable "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"source_name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Use "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"create"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for first push when"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"matching by hostname, IP, MAC, or cloud identifiers."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"deviceUid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" must be an existing Tenable asset UUID ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"device.uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in OCSF). Only one package"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"CPE is sent per request. Changing version means supplying a new CPE string; the previous CPE"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"is not removed automatically and ages out per Tenable rules. Does not support removal or"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"in-place CPE replacement. Software from other "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"source_name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" values is unaffected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"assets_update_software"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"deviceUid","in":"path","schemaId":"schema_9","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Uid of the device. For Tenable Cloud this is the Tenable asset UUID ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"device.uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in OCSF),"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"the same identifier returned by query devices and query software."},"children":[],"type":"text"}],"type":"paragraph"}],"required":true}],"pointer":"/paths/~1v1~1assets~1software~1{deviceUid}/put/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1assets~1software~1{deviceUid}/put/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/UpdateSoftwareInventoryRequest"}},"schemaId":"components/schemas/UpdateSoftwareInventoryRequest","pointer":"/paths/~1v1~1assets~1software~1{deviceUid}/put/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"PUT","path":"/v1/assets/software/{deviceUid}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"deviceUid","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/UpdateSoftwareInventoryRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/assets/software/{deviceUid}","href":"assets/assets_update_software","openApiOperationId":"assets_update_software","summary":"Update Software Inventory"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/UpdateSoftwareInventoryRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/UpdateSoftwareInventoryRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/UpdateSoftwareInventoryResponse"}},"schemaId":"components/schemas/UpdateSoftwareInventoryResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1assets~1software~1{deviceUid}/put/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/UpdateSoftwareInventoryResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/UpdateSoftwareInventoryResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/assets/assets_update_software"}],"panels":[]}]},"httpPath":"/v1/assets/software/{deviceUid}"}],"content":{"contentType":"group","meta":{"name":"Assets"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Assets","showPageActions":true}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/assets/devices","summary":"Query Devices","prefix":{"name":"get","color":"get"},"badges":[],"link":"/assets/assets_query_devices","deprecated":false},{"title":"/v1/assets/devices","summary":"Create Device","prefix":{"name":"post","color":"post"},"badges":[],"link":"/assets/assets_create_asset","deprecated":false},{"title":"/v1/assets/devices/bulk","summary":"Create Devices","prefix":{"name":"post","color":"post"},"badges":[],"link":"/assets/assets_create_devices","deprecated":false},{"title":"/v1/assets/labels","summary":"Get Labels","prefix":{"name":"get","color":"get"},"badges":[],"link":"/assets/assets_get_labels","deprecated":false},{"title":"/v1/assets/software","summary":"Query Software Inventory","prefix":{"name":"get","color":"get"},"badges":[],"link":"/assets/assets_query_software","deprecated":false},{"title":"/v1/assets/software","summary":"Create Software Inventory","prefix":{"name":"post","color":"post"},"badges":[],"link":"/assets/assets_create_software","deprecated":false},{"title":"/v1/assets/devices/{deviceUid}/software","summary":"Query Device Software Inventory","prefix":{"name":"get","color":"get"},"badges":[],"link":"/assets/assets_query_device_software","deprecated":false},{"title":"/v1/assets/software/{deviceUid}","summary":"Update Software Inventory","prefix":{"name":"put","color":"put"},"badges":[],"link":"/assets/assets_update_software","deprecated":false}]}]}]}]}},{"type":"group","label":"Chat","link":"/api-reference/connectors/chat","routeSlug":"/api-reference/connectors/chat","items":[{"label":"Query Users","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/chat/chat_query_users","routeSlug":"/api-reference/connectors/chat/chat_query_users","metadata":{"seo":{"title":"Query Users","description":"Returns a list of users in the connected workspace or tenant. Used to discover whose conversations can be queried."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"chat_query_users","name":"Query Users","isWebhook":false,"pointer":"/paths/~1v1~1chat~1users/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Users","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of users in the connected workspace or tenant. Used to discover whose conversations can be queried."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_query_users"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of users to return. Defaults to 100 with a maximum of 1000. If a provider has a maximum limit lower than 1000, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/chat/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the chat provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1chat~1users/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/chat/users","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","429","500","501","502","503","504"],"pointer":"/v1/chat/users","href":"chat/chat_query_users","openApiOperationId":"chat_query_users","summary":"Query Users"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatQueryUsersResponse"}},"schemaId":"components/schemas/ChatQueryUsersResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1chat~1users/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ChatQueryUsersResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatQueryUsersResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/chat/chat_query_users"}],"panels":[]}]},"httpPath":"/v1/chat/users"},{"label":"Query User Conversations","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/chat/chat_query_user_conversations","routeSlug":"/api-reference/connectors/chat/chat_query_user_conversations","metadata":{"seo":{"title":"Query User Conversations","description":"Returns a list of conversations scoped to a specific user — DMs, group chats, or (for AI providers) synthesised sessions."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"chat_query_user_conversations","name":"Query User Conversations","isWebhook":false,"pointer":"/paths/~1v1~1chat~1users~1{userId}~1conversations/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query User Conversations","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of conversations scoped to a specific user — DMs, group chats, or (for AI providers) synthesised sessions."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_query_user_conversations"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"userId","in":"path","schemaId":"schema_9","required":true}],"pointer":"/paths/~1v1~1chat~1users~1{userId}~1conversations/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":"Add metadata to the response by invoking meta functions."},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of conversations to return. Defaults to 100 with a maximum of 1000. If a provider has a maximum limit lower than 1000, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":"Filter results by this query. Defaults to no filter. If used more than once, the queries are ANDed together."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the chat provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1chat~1users~1{userId}~1conversations/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/chat/users/{userId}/conversations","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"userId","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","429","500","501","502","503","504"],"pointer":"/v1/chat/users/{userId}/conversations","href":"chat/chat_query_user_conversations","openApiOperationId":"chat_query_user_conversations","summary":"Query User Conversations"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatQueryConversationsResponse"}},"schemaId":"components/schemas/ChatQueryConversationsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1chat~1users~1{userId}~1conversations/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ChatQueryConversationsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatQueryConversationsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/chat/chat_query_user_conversations"}],"panels":[]}]},"httpPath":"/v1/chat/users/{userId}/conversations"},{"label":"Query User Conversation Members","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/chat/chat_query_user_conversation_members","routeSlug":"/api-reference/connectors/chat/chat_query_user_conversation_members","metadata":{"seo":{"title":"Query User Conversation Members","description":"Returns the members of a conversation scoped to a specific user. Required for providers where conversations are only addressable via the user (e.g. Teams DMs, Copilot AI sessions)."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"chat_query_user_conversation_members","name":"Query User Conversation Members","isWebhook":false,"pointer":"/paths/~1v1~1chat~1users~1{userId}~1conversations~1{conversationId}~1members/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query User Conversation Members","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the members of a conversation scoped to a specific user. Required for providers where conversations are only addressable via the user (e.g. Teams DMs, Copilot AI sessions)."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_query_user_conversation_members"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"userId","in":"path","schemaId":"schema_9","required":true},{"name":"conversationId","in":"path","schemaId":"schema_9","required":true}],"pointer":"/paths/~1v1~1chat~1users~1{userId}~1conversations~1{conversationId}~1members/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":"Add metadata to the response by invoking meta functions."},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of members to return. Defaults to 100 with a maximum of 1000. If a provider has a maximum limit lower than 1000, the provider's maximum limit will be used instead."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the chat provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1chat~1users~1{userId}~1conversations~1{conversationId}~1members/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/chat/users/{userId}/conversations/{conversationId}/members","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"userId","in":"path","required":true,"schemaId":"schema_9"},{"name":"conversationId","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","429","500","501","502","503","504"],"pointer":"/v1/chat/users/{userId}/conversations/{conversationId}/members","href":"chat/chat_query_user_conversation_members","openApiOperationId":"chat_query_user_conversation_members","summary":"Query User Conversation Members"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatQueryConversationMembersResponse"}},"schemaId":"components/schemas/ChatQueryConversationMembersResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1chat~1users~1{userId}~1conversations~1{conversationId}~1members/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ChatQueryConversationMembersResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatQueryConversationMembersResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/chat/chat_query_user_conversation_members"}],"panels":[]}]},"httpPath":"/v1/chat/users/{userId}/conversations/{conversationId}/members"},{"label":"Query User Conversation Messages","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/chat/chat_query_user_conversation_messages","routeSlug":"/api-reference/connectors/chat/chat_query_user_conversation_messages","metadata":{"seo":{"title":"Query User Conversation Messages","description":"Returns messages from a conversation scoped to a specific user. Required for providers where conversations are only addressable via the user (e.g. Teams DMs, Copilot AI sessions)."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"chat_query_user_conversation_messages","name":"Query User Conversation Messages","isWebhook":false,"pointer":"/paths/~1v1~1chat~1users~1{userId}~1conversations~1{conversationId}~1messages/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query User Conversation Messages","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns messages from a conversation scoped to a specific user. Required for providers where conversations are only addressable via the user (e.g. Teams DMs, Copilot AI sessions)."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_query_user_conversation_messages"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"userId","in":"path","schemaId":"schema_9","required":true},{"name":"conversationId","in":"path","schemaId":"schema_9","required":true}],"pointer":"/paths/~1v1~1chat~1users~1{userId}~1conversations~1{conversationId}~1messages/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":"Add metadata to the response by invoking meta functions."},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of messages to return. Defaults to 100 with a maximum of 1000. If a provider has a maximum limit lower than 1000, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":"Filter results by this query. Supported filter fields vary by provider. Defaults to no filter. If used more than once, the queries are ANDed together."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the chat provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1chat~1users~1{userId}~1conversations~1{conversationId}~1messages/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/chat/users/{userId}/conversations/{conversationId}/messages","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"userId","in":"path","required":true,"schemaId":"schema_9"},{"name":"conversationId","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","429","500","501","502","503","504"],"pointer":"/v1/chat/users/{userId}/conversations/{conversationId}/messages","href":"chat/chat_query_user_conversation_messages","openApiOperationId":"chat_query_user_conversation_messages","summary":"Query User Conversation Messages"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatQueryMessagesResponse"}},"schemaId":"components/schemas/ChatQueryMessagesResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1chat~1users~1{userId}~1conversations~1{conversationId}~1messages/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ChatQueryMessagesResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatQueryMessagesResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/chat/chat_query_user_conversation_messages"}],"panels":[]}]},"httpPath":"/v1/chat/users/{userId}/conversations/{conversationId}/messages"},{"label":"Query Conversations","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/chat/chat_query_conversations","routeSlug":"/api-reference/connectors/chat/chat_query_conversations","metadata":{"seo":{"title":"Query Conversations","description":"Returns a list of conversations (channels or workspaces) not scoped to a specific user. Providers that can only enumerate conversations per-user return NotImplemented; use query_user_conversations instead."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"chat_query_conversations","name":"Query Conversations","isWebhook":false,"pointer":"/paths/~1v1~1chat~1conversations/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Conversations","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of conversations (channels or workspaces) not scoped to a specific user. Providers that can only enumerate conversations per-user return NotImplemented; use query_user_conversations instead."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_query_conversations"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":"Add metadata to the response by invoking meta functions."},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of conversations to return. Defaults to 100 with a maximum of 1000. If a provider has a maximum limit lower than 1000, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":"Filter results by this query. Defaults to no filter. If used more than once, the queries are ANDed together."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the chat provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1chat~1conversations/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/chat/conversations","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","429","500","501","502","503","504"],"pointer":"/v1/chat/conversations","href":"chat/chat_query_conversations","openApiOperationId":"chat_query_conversations","summary":"Query Conversations"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatQueryConversationsResponse"}},"schemaId":"components/schemas/ChatQueryConversationsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1chat~1conversations/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ChatQueryConversationsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatQueryConversationsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/chat/chat_query_conversations"}],"panels":[]}]},"httpPath":"/v1/chat/conversations"},{"label":"Query Conversation Members","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/chat/chat_query_conversation_members","routeSlug":"/api-reference/connectors/chat/chat_query_conversation_members","metadata":{"seo":{"title":"Query Conversation Members","description":"Returns the members of a specific conversation. Use the user-scoped variant (query_user_conversation_members) for chats that only exist in a user's mailbox (e.g. Teams 1:1 chats). Where the provider supports create_direct_message, the conversation UID it returns is accepted here."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"chat_query_conversation_members","name":"Query Conversation Members","isWebhook":false,"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1members/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Conversation Members","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the members of a specific conversation. Use the user-scoped variant (query_user_conversation_members) for chats that only exist in a user's mailbox (e.g. Teams 1:1 chats). Where the provider supports create_direct_message, the conversation UID it returns is accepted here."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_query_conversation_members"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"conversationId","in":"path","schemaId":"schema_9","required":true}],"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1members/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":"Add metadata to the response by invoking meta functions."},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of members to return. Defaults to 100 with a maximum of 1000. If a provider has a maximum limit lower than 1000, the provider's maximum limit will be used instead."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the chat provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1members/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/chat/conversations/{conversationId}/members","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"conversationId","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","429","500","501","502","503","504"],"pointer":"/v1/chat/conversations/{conversationId}/members","href":"chat/chat_query_conversation_members","openApiOperationId":"chat_query_conversation_members","summary":"Query Conversation Members"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatQueryConversationMembersResponse"}},"schemaId":"components/schemas/ChatQueryConversationMembersResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1members/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ChatQueryConversationMembersResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatQueryConversationMembersResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/chat/chat_query_conversation_members"}],"panels":[]}]},"httpPath":"/v1/chat/conversations/{conversationId}/members"},{"label":"Query Messages","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/chat/chat_query_messages","routeSlug":"/api-reference/connectors/chat/chat_query_messages","metadata":{"seo":{"title":"Query Messages","description":"Returns all messages across every conversation in the connected workspace or tenant."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"chat_query_messages","name":"Query Messages","isWebhook":false,"pointer":"/paths/~1v1~1chat~1messages/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Messages","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns all messages across every conversation in the connected workspace or tenant."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_query_messages"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":"Add metadata to the response by invoking meta functions."},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of messages to return per page. Defaults to 100 with a maximum of 1000. If a provider has a maximum limit lower than 1000, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. Only an optional time window ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time[gte]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"/"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time[lte]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") is supported, and only for providers whose message APIs support time filtering. Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the chat provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1chat~1messages/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/chat/messages","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","403","404","405","429","500","501","502","503","504"],"pointer":"/v1/chat/messages","href":"chat/chat_query_messages","openApiOperationId":"chat_query_messages","summary":"Query Messages"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatQueryMessagesResponse"}},"schemaId":"components/schemas/ChatQueryMessagesResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1chat~1messages/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ChatQueryMessagesResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatQueryMessagesResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/chat/chat_query_messages"}],"panels":[]}]},"httpPath":"/v1/chat/messages"},{"label":"Query Conversation Messages","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/chat/chat_query_conversation_messages","routeSlug":"/api-reference/connectors/chat/chat_query_conversation_messages","metadata":{"seo":{"title":"Query Conversation Messages","description":"Returns messages from a specific conversation. The conversationId must be obtained from query_conversations or query_user_conversations. Use the user-scoped variant (query_user_conversation_messages) for chats that only exist in a user's mailbox. Where the provider supports create_direct_message, the conversation UID it returns is accepted here. Where the provider declares a chat_message.parent_uid filter, filtering on it with the uid of a thread's top-level message returns that thread's replies instead."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"chat_query_conversation_messages","name":"Query Conversation Messages","isWebhook":false,"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1messages/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Conversation Messages","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns messages from a specific conversation. The conversationId must be obtained from query_conversations or query_user_conversations. Use the user-scoped variant (query_user_conversation_messages) for chats that only exist in a user's mailbox. Where the provider supports create_direct_message, the conversation UID it returns is accepted here. Where the provider declares a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_message.parent_uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" filter, filtering on it with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of a thread's top-level message returns that thread's replies instead."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_query_conversation_messages"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"conversationId","in":"path","schemaId":"schema_9","required":true}],"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1messages/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":"Add metadata to the response by invoking meta functions."},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of messages to return. Defaults to 100 with a maximum of 1000. If a provider has a maximum limit lower than 1000, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":"Filter results by this query. Supported filter fields vary by provider. Defaults to no filter. If used more than once, the queries are ANDed together."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the chat provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1messages/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/chat/conversations/{conversationId}/messages","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"conversationId","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","429","500","501","502","503","504"],"pointer":"/v1/chat/conversations/{conversationId}/messages","href":"chat/chat_query_conversation_messages","openApiOperationId":"chat_query_conversation_messages","summary":"Query Conversation Messages"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatQueryMessagesResponse"}},"schemaId":"components/schemas/ChatQueryMessagesResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1messages/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ChatQueryMessagesResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatQueryMessagesResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/chat/chat_query_conversation_messages"}],"panels":[]}]},"httpPath":"/v1/chat/conversations/{conversationId}/messages"},{"label":"Create Message","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/chat/chat_create_message","routeSlug":"/api-reference/connectors/chat/chat_create_message","metadata":{"seo":{"title":"Create Message","description":"Posts a message to a conversation as the integration's bot or app, either as a new top-level message or as a reply in a thread. The response carries the message's uid, which update_message and delete_message accept."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"chat_create_message","name":"Create Message","isWebhook":false,"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1messages/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Create Message","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Posts a message to a conversation as the integration's bot or app, either as a new top-level message or as a reply in a thread. The response carries the message's "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", which update_message and delete_message accept."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_create_message"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"conversationId","in":"path","schemaId":"schema_9","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UID of the conversation (URL encoded). This is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_message.conversation_uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in the OCSF model."},"children":[],"type":"text"}],"type":"paragraph"}],"required":true}],"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1messages/post/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1messages/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_10"}},"schemaId":"schema_10","pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1messages/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/chat/conversations/{conversationId}/messages","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"conversationId","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"schema_10"}},"responseCodes":["200","400","401","402","403","404","405","415","429","500","501","502","503","504"],"pointer":"/v1/chat/conversations/{conversationId}/messages","href":"chat/chat_create_message","openApiOperationId":"chat_create_message","summary":"Create Message"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"schema_10","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_10"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatMessageResponse"}},"schemaId":"components/schemas/ChatMessageResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1messages/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ChatMessageResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatMessageResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/chat/chat_create_message"}],"panels":[]}]},"httpPath":"/v1/chat/conversations/{conversationId}/messages"},{"label":"Create Direct Message","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/chat/chat_create_direct_message","routeSlug":"/api-reference/connectors/chat/chat_create_direct_message","metadata":{"seo":{"title":"Create Direct Message","description":"Sends a direct message to one user, opening the direct conversation if it does not exist yet. The response's chat_message.conversation_uid addresses that conversation for later messages and reads."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"chat_create_direct_message","name":"Create Direct Message","isWebhook":false,"pointer":"/paths/~1v1~1chat~1direct-messages/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Create Direct Message","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Sends a direct message to one user, opening the direct conversation if it does not exist yet. The response's "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_message.conversation_uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" addresses that conversation for later messages and reads."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_create_direct_message"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1chat~1direct-messages/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_11"}},"schemaId":"schema_11","pointer":"/paths/~1v1~1chat~1direct-messages/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/chat/direct-messages","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"schema_11"}},"responseCodes":["200","400","401","402","403","404","405","415","429","500","501","502","503","504"],"pointer":"/v1/chat/direct-messages","href":"chat/chat_create_direct_message","openApiOperationId":"chat_create_direct_message","summary":"Create Direct Message"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"schema_11","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_11"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatMessageResponse"}},"schemaId":"components/schemas/ChatMessageResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1chat~1direct-messages/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ChatMessageResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatMessageResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/chat/chat_create_direct_message"}],"panels":[]}]},"httpPath":"/v1/chat/direct-messages"},{"label":"Update Message","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/chat/chat_update_message","routeSlug":"/api-reference/connectors/chat/chat_update_message","metadata":{"seo":{"title":"Update Message","description":"Replaces the text of a message the integration sent. Messages sent by anyone else cannot be updated, and a provider's admin policy can forbid edits. The response can lack chat_message.parent_uid; the create_message response for a reply carries it."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"chat_update_message","name":"Update Message","isWebhook":false,"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1messages~1{messageId}/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Update Message","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Replaces the text of a message the integration sent. Messages sent by anyone else cannot be updated, and a provider's admin policy can forbid edits. The response can lack "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_message.parent_uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"; the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"create_message"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" response for a reply carries it."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_update_message"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"conversationId","in":"path","schemaId":"schema_9","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UID of the conversation (URL encoded). This is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_message.conversation_uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in the OCSF model."},"children":[],"type":"text"}],"type":"paragraph"}],"required":true},{"name":"messageId","in":"path","schemaId":"schema_9","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UID of the message (URL encoded). This is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_message.uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in the OCSF model."},"children":[],"type":"text"}],"type":"paragraph"}],"required":true}],"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1messages~1{messageId}/post/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1messages~1{messageId}/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_12"}},"schemaId":"schema_12","pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1messages~1{messageId}/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/chat/conversations/{conversationId}/messages/{messageId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"conversationId","in":"path","required":true,"schemaId":"schema_9"},{"name":"messageId","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"schema_12"}},"responseCodes":["200","400","401","402","403","404","405","415","429","500","501","502","503","504"],"pointer":"/v1/chat/conversations/{conversationId}/messages/{messageId}","href":"chat/chat_update_message","openApiOperationId":"chat_update_message","summary":"Update Message"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"schema_12","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_12"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatMessageResponse"}},"schemaId":"components/schemas/ChatMessageResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1messages~1{messageId}/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ChatMessageResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ChatMessageResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/chat/chat_update_message"}],"panels":[]}]},"httpPath":"/v1/chat/conversations/{conversationId}/messages/{messageId}"},{"label":"Delete Message","deprecated":false,"httpVerb":"delete","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/chat/chat_delete_message","routeSlug":"/api-reference/connectors/chat/chat_delete_message","metadata":{"seo":{"title":"Delete Message","description":"Deletes a message the integration sent. Messages sent by anyone else cannot be deleted, and a provider's admin policy can forbid deletes."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"chat_delete_message","name":"Delete Message","isWebhook":false,"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1messages~1{messageId}/delete","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Delete Message","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Deletes a message the integration sent. Messages sent by anyone else cannot be deleted, and a provider's admin policy can forbid deletes."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_delete_message"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"conversationId","in":"path","schemaId":"schema_9","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UID of the conversation (URL encoded). This is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_message.conversation_uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in the OCSF model."},"children":[],"type":"text"}],"type":"paragraph"}],"required":true},{"name":"messageId","in":"path","schemaId":"schema_9","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UID of the message (URL encoded). This is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"chat_message.uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in the OCSF model."},"children":[],"type":"text"}],"type":"paragraph"}],"required":true}],"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1messages~1{messageId}/delete/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1messages~1{messageId}/delete/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"DELETE","path":"/v1/chat/conversations/{conversationId}/messages/{messageId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"conversationId","in":"path","required":true,"schemaId":"schema_9"},{"name":"messageId","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["204","400","401","402","403","404","405","429","500","501","502","503","504"],"pointer":"/v1/chat/conversations/{conversationId}/messages/{messageId}","href":"chat/chat_delete_message","openApiOperationId":"chat_delete_message","summary":"Delete Message"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1chat~1conversations~1{conversationId}~1messages~1{messageId}/delete/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"204"},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/chat/chat_delete_message"}],"panels":[]}]},"httpPath":"/v1/chat/conversations/{conversationId}/messages/{messageId}"}],"content":{"contentType":"group","meta":{"name":"Chat"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Chat","showPageActions":true}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/chat/users","summary":"Query Users","prefix":{"name":"get","color":"get"},"badges":[],"link":"/chat/chat_query_users","deprecated":false},{"title":"/v1/chat/users/{userId}/conversations","summary":"Query User Conversations","prefix":{"name":"get","color":"get"},"badges":[],"link":"/chat/chat_query_user_conversations","deprecated":false},{"title":"/v1/chat/users/{userId}/conversations/{conversationId}/members","summary":"Query User Conversation Members","prefix":{"name":"get","color":"get"},"badges":[],"link":"/chat/chat_query_user_conversation_members","deprecated":false},{"title":"/v1/chat/users/{userId}/conversations/{conversationId}/messages","summary":"Query User Conversation Messages","prefix":{"name":"get","color":"get"},"badges":[],"link":"/chat/chat_query_user_conversation_messages","deprecated":false},{"title":"/v1/chat/conversations","summary":"Query Conversations","prefix":{"name":"get","color":"get"},"badges":[],"link":"/chat/chat_query_conversations","deprecated":false},{"title":"/v1/chat/conversations/{conversationId}/members","summary":"Query Conversation Members","prefix":{"name":"get","color":"get"},"badges":[],"link":"/chat/chat_query_conversation_members","deprecated":false},{"title":"/v1/chat/messages","summary":"Query Messages","prefix":{"name":"get","color":"get"},"badges":[],"link":"/chat/chat_query_messages","deprecated":false},{"title":"/v1/chat/conversations/{conversationId}/messages","summary":"Query Conversation Messages","prefix":{"name":"get","color":"get"},"badges":[],"link":"/chat/chat_query_conversation_messages","deprecated":false},{"title":"/v1/chat/conversations/{conversationId}/messages","summary":"Create Message","prefix":{"name":"post","color":"post"},"badges":[],"link":"/chat/chat_create_message","deprecated":false},{"title":"/v1/chat/direct-messages","summary":"Create Direct Message","prefix":{"name":"post","color":"post"},"badges":[],"link":"/chat/chat_create_direct_message","deprecated":false},{"title":"/v1/chat/conversations/{conversationId}/messages/{messageId}","summary":"Update Message","prefix":{"name":"post","color":"post"},"badges":[],"link":"/chat/chat_update_message","deprecated":false},{"title":"/v1/chat/conversations/{conversationId}/messages/{messageId}","summary":"Delete Message","prefix":{"name":"delete","color":"delete"},"badges":[],"link":"/chat/chat_delete_message","deprecated":false}]}]}]}]}},{"type":"group","label":"Cloud Security (In Development)","link":"/api-reference/connectors/cloudsecurity","routeSlug":"/api-reference/connectors/cloudsecurity","items":[{"label":"Query Events","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/cloudsecurity/cloudsecurity_query_events","routeSlug":"/api-reference/connectors/cloudsecurity/cloudsecurity_query_events","metadata":{"seo":{"title":"Query Events","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"cloudsecurity_query_events","name":"Query Events","isWebhook":false,"pointer":"/paths/~1v1~1cloudsecurity~1events/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Events","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of events that match the query from the cloud security provider."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"cloudsecurity_query_events"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of events to return. Defaults to 100."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/cloudsecurity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."}],"pointer":"/paths/~1v1~1cloudsecurity~1events/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/cloudsecurity/events","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405"],"pointer":"/v1/cloudsecurity/events","href":"cloudsecurity/cloudsecurity_query_events","openApiOperationId":"cloudsecurity_query_events","summary":"Query Events"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryEventsResponse"}},"schemaId":"components/schemas/QueryEventsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1cloudsecurity~1events/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryEventsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryEventsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/cloudsecurity/cloudsecurity_query_events"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/cloudsecurity/events"},{"label":"Query IOMs","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/cloudsecurity/cloudsecurity_query_ioms","routeSlug":"/api-reference/connectors/cloudsecurity/cloudsecurity_query_ioms","metadata":{"seo":{"title":"Query IOMs","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"cloudsecurity_query_ioms","name":"Query IOMs","isWebhook":false,"pointer":"/paths/~1v1~1cloudsecurity~1ioms/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query IOMs","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of Indicators of Misconfiguration (IOM) findings that match the query from the cloud security provider."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"cloudsecurity_query_ioms"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of cloud resources to return. Defaults to 500."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/cloudsecurity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the CloudSecurity in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1cloudsecurity~1ioms/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/cloudsecurity/ioms","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405"],"pointer":"/v1/cloudsecurity/ioms","href":"cloudsecurity/cloudsecurity_query_ioms","openApiOperationId":"cloudsecurity_query_ioms","summary":"Query IOMs"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryIomsResponse"}},"schemaId":"components/schemas/QueryIomsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1cloudsecurity~1ioms/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryIomsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryIomsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/cloudsecurity/cloudsecurity_query_ioms"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/cloudsecurity/ioms"},{"label":"Query Cloud Resource Inventory","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/cloudsecurity/cloudsecurity_query_cloud_resource_inventory","routeSlug":"/api-reference/connectors/cloudsecurity/cloudsecurity_query_cloud_resource_inventory","metadata":{"seo":{"title":"Query Cloud Resource Inventory","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"cloudsecurity_query_cloud_resource_inventory","name":"Query Cloud Resource Inventory","isWebhook":false,"pointer":"/paths/~1v1~1cloudsecurity~1cloudresourcesinventory/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Cloud Resource Inventory","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of cloud resources that match the query from the cloud security provider."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"cloudsecurity_query_cloud_resource_inventory"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of cloud resources to return. Defaults to 500."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/cloudsecurity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the CloudSecurity in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1cloudsecurity~1cloudresourcesinventory/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/cloudsecurity/cloudresourcesinventory","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405"],"pointer":"/v1/cloudsecurity/cloudresourcesinventory","href":"cloudsecurity/cloudsecurity_query_cloud_resource_inventory","openApiOperationId":"cloudsecurity_query_cloud_resource_inventory","summary":"Query Cloud Resource Inventory"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryCloudResourceInventoryResponse"}},"schemaId":"components/schemas/QueryCloudResourceInventoryResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1cloudsecurity~1cloudresourcesinventory/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryCloudResourceInventoryResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryCloudResourceInventoryResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/cloudsecurity/cloudsecurity_query_cloud_resource_inventory"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/cloudsecurity/cloudresourcesinventory"},{"label":"Query Compliance Findings","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/cloudsecurity/cloudsecurity_query_compliance_findings","routeSlug":"/api-reference/connectors/cloudsecurity/cloudsecurity_query_compliance_findings","metadata":{"seo":{"title":"Query Compliance Findings","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"cloudsecurity_query_compliance_findings","name":"Query Compliance Findings","isWebhook":false,"pointer":"/paths/~1v1~1cloudsecurity~1compliancefindings/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Compliance Findings","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of compliance findings matching the query from the cloud security provider."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"cloudsecurity_query_compliance_findings"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of compliance findings to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/cloudsecurity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the CloudSecurity in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1cloudsecurity~1compliancefindings/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/cloudsecurity/compliancefindings","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/cloudsecurity/compliancefindings","href":"cloudsecurity/cloudsecurity_query_compliance_findings","openApiOperationId":"cloudsecurity_query_compliance_findings","summary":"Query Compliance Findings"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryComplianceFindingsResponse"}},"schemaId":"components/schemas/QueryComplianceFindingsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1cloudsecurity~1compliancefindings/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryComplianceFindingsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryComplianceFindingsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/cloudsecurity/cloudsecurity_query_compliance_findings"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/cloudsecurity/compliancefindings"},{"label":"Query Threats","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/cloudsecurity/cloudsecurity_query_threats","routeSlug":"/api-reference/connectors/cloudsecurity/cloudsecurity_query_threats","metadata":{"seo":{"title":"Query Threats","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"cloudsecurity_query_threats","name":"Query Threats","isWebhook":false,"pointer":"/paths/~1v1~1cloudsecurity~1threats/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Threats","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of threat detections that match the query from the cloud security provider."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"cloudsecurity_query_threats"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of threats to return. Defaults to 100."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/cloudsecurity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the CloudSecurity in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1cloudsecurity~1threats/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/cloudsecurity/threats","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/cloudsecurity/threats","href":"cloudsecurity/cloudsecurity_query_threats","openApiOperationId":"cloudsecurity_query_threats","summary":"Query Threats"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryCloudSecurityThreatsResponse"}},"schemaId":"components/schemas/QueryCloudSecurityThreatsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1cloudsecurity~1threats/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryCloudSecurityThreatsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryCloudSecurityThreatsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/cloudsecurity/cloudsecurity_query_threats"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/cloudsecurity/threats"}],"content":{"contentType":"group","meta":{"name":"Cloudsecurity"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Cloud Security (In Development)","showPageActions":true},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This feature is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this feature."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"}]}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/cloudsecurity/events","summary":"Query Events","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/cloudsecurity/cloudsecurity_query_events","deprecated":false},{"title":"/v1/cloudsecurity/ioms","summary":"Query IOMs","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/cloudsecurity/cloudsecurity_query_ioms","deprecated":false},{"title":"/v1/cloudsecurity/cloudresourcesinventory","summary":"Query Cloud Resource Inventory","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/cloudsecurity/cloudsecurity_query_cloud_resource_inventory","deprecated":false},{"title":"/v1/cloudsecurity/compliancefindings","summary":"Query Compliance Findings","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/cloudsecurity/cloudsecurity_query_compliance_findings","deprecated":false},{"title":"/v1/cloudsecurity/threats","summary":"Query Threats","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/cloudsecurity/cloudsecurity_query_threats","deprecated":false}]}]}]}]}},{"type":"group","label":"Endpoint Detection & Response (EDR)","link":"/api-reference/connectors/edr","routeSlug":"/api-reference/connectors/edr","items":[{"label":"Query Endpoints","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_query_endpoints","routeSlug":"/api-reference/connectors/edr/edr_query_endpoints","metadata":{"seo":{"title":"Query Endpoints","description":"Returns a list of endpoint assets matching the query from the token-linked EDR source."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_query_endpoints","name":"Query Endpoints","isWebhook":false,"pointer":"/paths/~1v1~1edr~1endpoints/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Endpoints","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of endpoint assets matching the query from the token-linked EDR source."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_query_endpoints"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of endpoint assets to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/edr/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the EDR in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1edr~1endpoints/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/edr/endpoints","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/endpoints","href":"edr/edr_query_endpoints","openApiOperationId":"edr_query_endpoints","summary":"Query Endpoints"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryEndpointsResponse"}},"schemaId":"components/schemas/QueryEndpointsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1endpoints/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryEndpointsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryEndpointsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_query_endpoints"}],"panels":[]}]},"httpPath":"/v1/edr/endpoints"},{"label":"Get Endpoint","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_get_endpoint","routeSlug":"/api-reference/connectors/edr/edr_get_endpoint","metadata":{"seo":{"title":"Get Endpoint","description":"Gets a single endpoint assets matching the UID from the token-linked EDR source."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_get_endpoint","name":"Get Endpoint","isWebhook":false,"pointer":"/paths/~1v1~1edr~1endpoints~1{id}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Endpoint","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Gets a single endpoint assets matching the UID from the token-linked EDR source."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_get_endpoint"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"id","in":"path","schemaId":"schema_13","required":true}],"pointer":"/paths/~1v1~1edr~1endpoints~1{id}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1edr~1endpoints~1{id}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/edr/endpoints/{id}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"id","in":"path","required":true,"schemaId":"components/schemas/ApplicationId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/endpoints/{id}","href":"edr/edr_get_endpoint","openApiOperationId":"edr_get_endpoint","summary":"Get Endpoint"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetEndpointResponse"}},"schemaId":"components/schemas/GetEndpointResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1endpoints~1{id}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetEndpointResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetEndpointResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_get_endpoint"}],"panels":[]}]},"httpPath":"/v1/edr/endpoints/{id}"},{"label":"Execute Command","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_execute_command","routeSlug":"/api-reference/connectors/edr/edr_execute_command","metadata":{"seo":{"title":"Execute Command","description":"Runs a provider-backed command on the endpoint identified by {uid} and returns normalized stdout and stderr without exposing provider session details."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_execute_command","name":"Execute Command","isWebhook":false,"pointer":"/paths/~1v1~1edr~1endpoints~1{uid}~1actions~1execute-command/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Execute Command","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Runs a provider-backed command on the endpoint identified by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{uid}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and returns normalized stdout and stderr without exposing provider session details."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_execute_command"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"uid","in":"path","schemaId":"schema_13","required":true}],"pointer":"/paths/~1v1~1edr~1endpoints~1{uid}~1actions~1execute-command/post/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1edr~1endpoints~1{uid}~1actions~1execute-command/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/ExecuteCommandRequest"}},"schemaId":"components/schemas/ExecuteCommandRequest","pointer":"/paths/~1v1~1edr~1endpoints~1{uid}~1actions~1execute-command/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/edr/endpoints/{uid}/actions/execute-command","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"uid","in":"path","required":true,"schemaId":"components/schemas/ApplicationId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/ExecuteCommandRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/endpoints/{uid}/actions/execute-command","href":"edr/edr_execute_command","openApiOperationId":"edr_execute_command","summary":"Execute Command"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/ExecuteCommandRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/ExecuteCommandRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ExecuteCommandResponse"}},"schemaId":"components/schemas/ExecuteCommandResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1endpoints~1{uid}~1actions~1execute-command/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ExecuteCommandResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ExecuteCommandResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_execute_command"}],"panels":[]}]},"httpPath":"/v1/edr/endpoints/{uid}/actions/execute-command"},{"label":"Execute Remote Script","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_execute_remote_script","routeSlug":"/api-reference/connectors/edr/edr_execute_remote_script","metadata":{"seo":{"title":"Execute Remote Script","description":"Runs a script on the endpoint identified by {uid} and returns normalized stdout and stderr without exposing provider session details. Long-running executions return a pending status with a cursor to resume polling."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_execute_remote_script","name":"Execute Remote Script","isWebhook":false,"pointer":"/paths/~1v1~1edr~1endpoints~1{uid}~1actions~1execute-remote-script/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Execute Remote Script","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Runs a script on the endpoint identified by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{uid}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and returns normalized stdout and stderr without exposing provider session details. Long-running executions return a pending status with a cursor to resume polling."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_execute_remote_script"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"uid","in":"path","schemaId":"schema_13","required":true}],"pointer":"/paths/~1v1~1edr~1endpoints~1{uid}~1actions~1execute-remote-script/post/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1edr~1endpoints~1{uid}~1actions~1execute-remote-script/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/ExecuteRemoteScriptRequest"}},"schemaId":"components/schemas/ExecuteRemoteScriptRequest","pointer":"/paths/~1v1~1edr~1endpoints~1{uid}~1actions~1execute-remote-script/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/edr/endpoints/{uid}/actions/execute-remote-script","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"uid","in":"path","required":true,"schemaId":"components/schemas/ApplicationId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/ExecuteRemoteScriptRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/endpoints/{uid}/actions/execute-remote-script","href":"edr/edr_execute_remote_script","openApiOperationId":"edr_execute_remote_script","summary":"Execute Remote Script"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/ExecuteRemoteScriptRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/ExecuteRemoteScriptRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ExecuteRemoteScriptResponse"}},"schemaId":"components/schemas/ExecuteRemoteScriptResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1endpoints~1{uid}~1actions~1execute-remote-script/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ExecuteRemoteScriptResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ExecuteRemoteScriptResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_execute_remote_script"}],"panels":[]}]},"httpPath":"/v1/edr/endpoints/{uid}/actions/execute-remote-script"},{"label":"Retrieve File","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_retrieve_file","routeSlug":"/api-reference/connectors/edr/edr_retrieve_file","metadata":{"seo":{"title":"Retrieve File","description":"Retrieves a file from the endpoint identified by {uid} and returns the provider artifact as a binary file response."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_retrieve_file","name":"Retrieve File","isWebhook":false,"pointer":"/paths/~1v1~1edr~1endpoints~1{uid}~1actions~1retrieve-file/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Retrieve File","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Retrieves a file from the endpoint identified by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{uid}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and returns the provider artifact as a binary file response."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_retrieve_file"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"uid","in":"path","schemaId":"schema_13","required":true}],"pointer":"/paths/~1v1~1edr~1endpoints~1{uid}~1actions~1retrieve-file/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/RetrieveFileRequest"}},"schemaId":"components/schemas/RetrieveFileRequest","pointer":"/paths/~1v1~1edr~1endpoints~1{uid}~1actions~1retrieve-file/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/edr/endpoints/{uid}/actions/retrieve-file","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"uid","in":"path","required":true,"schemaId":"components/schemas/ApplicationId"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/RetrieveFileRequest"}},"responseCodes":["204","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/endpoints/{uid}/actions/retrieve-file","href":"edr/edr_retrieve_file","openApiOperationId":"edr_retrieve_file","summary":"Retrieve File"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/RetrieveFileRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/RetrieveFileRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1endpoints~1{uid}~1actions~1retrieve-file/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"204"},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_retrieve_file"}],"panels":[]}]},"httpPath":"/v1/edr/endpoints/{uid}/actions/retrieve-file"},{"label":"Query Applications","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_query_applications","routeSlug":"/api-reference/connectors/edr/edr_query_applications","metadata":{"seo":{"title":"Query Applications","description":"Returns a list of applications matching the query from the token-linked EDR source."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_query_applications","name":"Query Applications","isWebhook":false,"pointer":"/paths/~1v1~1edr~1applications/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Applications","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of applications matching the query from the token-linked EDR source."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_query_applications"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of applications to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/edr/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the EDR in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1edr~1applications/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/edr/applications","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/applications","href":"edr/edr_query_applications","openApiOperationId":"edr_query_applications","summary":"Query Applications"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryApplicationsResponse"}},"schemaId":"components/schemas/QueryApplicationsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1applications/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryApplicationsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryApplicationsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_query_applications"}],"panels":[]}]},"httpPath":"/v1/edr/applications"},{"label":"Quarantine Endpoints","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_network_quarantine","routeSlug":"/api-reference/connectors/edr/edr_network_quarantine","metadata":{"seo":{"title":"Quarantine Endpoints","description":"Connect or disconnect one or more endpoints assets to the network, allowing or disallowing connections."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_network_quarantine","name":"Quarantine Endpoints","isWebhook":false,"pointer":"/paths/~1v1~1edr~1endpoints~1actions~1quarantine/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Quarantine Endpoints","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Connect or disconnect one or more endpoints assets to the network, allowing or disallowing connections."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_network_quarantine"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1edr~1endpoints~1actions~1quarantine/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/NetworkQuarantineRequest"}},"schemaId":"components/schemas/NetworkQuarantineRequest","pointer":"/paths/~1v1~1edr~1endpoints~1actions~1quarantine/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/edr/endpoints/actions/quarantine","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/NetworkQuarantineRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/endpoints/actions/quarantine","href":"edr/edr_network_quarantine","openApiOperationId":"edr_network_quarantine","summary":"Quarantine Endpoints"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/NetworkQuarantineRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/NetworkQuarantineRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/NetworkQuarantineResponse"}},"schemaId":"components/schemas/NetworkQuarantineResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1endpoints~1actions~1quarantine/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/NetworkQuarantineResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/NetworkQuarantineResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_network_quarantine"}],"panels":[]}]},"httpPath":"/v1/edr/endpoints/actions/quarantine"},{"label":"Query Threat Events","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_query_threatevents","routeSlug":"/api-reference/connectors/edr/edr_query_threatevents","metadata":{"seo":{"title":"Query Threat Events","description":"Returns a list of threats that match the query from the token-linked EDR source."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_query_threatevents","name":"Query Threat Events","isWebhook":false,"pointer":"/paths/~1v1~1edr~1threats/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Threat Events","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of threats that match the query from the token-linked EDR source."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_query_threatevents"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of threats to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/edr/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the EDR in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1edr~1threats/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/edr/threats","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/threats","href":"edr/edr_query_threatevents","openApiOperationId":"edr_query_threatevents","summary":"Query Threat Events"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryThreatsResponse"}},"schemaId":"components/schemas/QueryThreatsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1threats/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryThreatsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryThreatsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_query_threatevents"}],"panels":[]}]},"httpPath":"/v1/edr/threats"},{"label":"Query Alerts","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_query_alerts","routeSlug":"/api-reference/connectors/edr/edr_query_alerts","metadata":{"seo":{"title":"Query Alerts","description":"Returns a list of alerts that match the query from the token-linked EDR source."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_query_alerts","name":"Query Alerts","isWebhook":false,"pointer":"/paths/~1v1~1edr~1alerts/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Alerts","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of alerts that match the query from the token-linked EDR source."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_query_alerts"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of threats to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/edr/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the EDR in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1edr~1alerts/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/edr/alerts","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/alerts","href":"edr/edr_query_alerts","openApiOperationId":"edr_query_alerts","summary":"Query Alerts"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryAlertsResponse"}},"schemaId":"components/schemas/QueryAlertsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1alerts/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryAlertsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryAlertsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_query_alerts"}],"panels":[]}]},"httpPath":"/v1/edr/alerts"},{"label":"Update Alert","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_update_alert","routeSlug":"/api-reference/connectors/edr/edr_update_alert","metadata":{"seo":{"title":"Update Alert","description":"Updates the triage state of a single alert in the token-linked EDR source: its lifecycle status, the analyst verdict, a comment and who it is assigned to."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_update_alert","name":"Update Alert","isWebhook":false,"pointer":"/paths/~1v1~1edr~1alerts~1{alertId}/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Update Alert","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Updates the triage state of a single alert in the token-linked EDR source: its lifecycle status, the analyst verdict, a comment and who it is assigned to."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_update_alert"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"alertId","in":"path","schemaId":"schema_9","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UID of the Alert (URL encoded). This will be "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info.uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in the OCSF model."},"children":[],"type":"text"}],"type":"paragraph"}],"required":true}],"pointer":"/paths/~1v1~1edr~1alerts~1{alertId}/post/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1edr~1alerts~1{alertId}/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/UpdateAlertRequest"}},"schemaId":"components/schemas/UpdateAlertRequest","pointer":"/paths/~1v1~1edr~1alerts~1{alertId}/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/edr/alerts/{alertId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"alertId","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/UpdateAlertRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/alerts/{alertId}","href":"edr/edr_update_alert","openApiOperationId":"edr_update_alert","summary":"Update Alert"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/UpdateAlertRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/UpdateAlertRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/UpdateAlertResponse"}},"schemaId":"components/schemas/UpdateAlertResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1alerts~1{alertId}/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/UpdateAlertResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/UpdateAlertResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_update_alert"}],"panels":[]}]},"httpPath":"/v1/edr/alerts/{alertId}"},{"label":"Query IOCs","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_query_iocs","routeSlug":"/api-reference/connectors/edr/edr_query_iocs","metadata":{"seo":{"title":"Query IOCs","description":"Returns a list of iocs that match the query from the token-linked EDR source."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_query_iocs","name":"Query IOCs","isWebhook":false,"pointer":"/paths/~1v1~1edr~1iocs/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query IOCs","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of iocs that match the query from the token-linked EDR source."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_query_iocs"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of threats to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/edr/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the EDR in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1edr~1iocs/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/edr/iocs","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/iocs","href":"edr/edr_query_iocs","openApiOperationId":"edr_query_iocs","summary":"Query IOCs"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryIocsResponse"}},"schemaId":"components/schemas/QueryIocsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1iocs/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryIocsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryIocsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_query_iocs"}],"panels":[]}]},"httpPath":"/v1/edr/iocs"},{"label":"Create IOCs","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_create_iocs","routeSlug":"/api-reference/connectors/edr/edr_create_iocs","metadata":{"seo":{"title":"Create IOCs","description":"Creates a list of iocs that match the stix input for the EDR source."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_create_iocs","name":"Create IOCs","isWebhook":false,"pointer":"/paths/~1v1~1edr~1iocs/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Create IOCs","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Creates a list of iocs that match the stix input for the EDR source."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_create_iocs"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1edr~1iocs/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateIocsRequest"}},"schemaId":"components/schemas/CreateIocsRequest","pointer":"/paths/~1v1~1edr~1iocs/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/edr/iocs","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/CreateIocsRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/iocs","href":"edr/edr_create_iocs","openApiOperationId":"edr_create_iocs","summary":"Create IOCs"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/CreateIocsRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateIocsRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateIocsResponse"}},"schemaId":"components/schemas/CreateIocsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1iocs/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/CreateIocsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateIocsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_create_iocs"}],"panels":[]}]},"httpPath":"/v1/edr/iocs"},{"label":"Delete IOCs","deprecated":false,"httpVerb":"delete","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_delete_iocs","routeSlug":"/api-reference/connectors/edr/edr_delete_iocs","metadata":{"seo":{"title":"Delete IOCs","description":"Deletes a list of iocs that match the input of ids in the query param"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_delete_iocs","name":"Delete IOCs","isWebhook":false,"pointer":"/paths/~1v1~1edr~1iocs/delete","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Delete IOCs","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Deletes a list of iocs that match the input of ids in the query param"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_delete_iocs"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"ids","in":"query","schemaId":"schema_2","description":"list of ids to delete"}],"pointer":"/paths/~1v1~1edr~1iocs/delete/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"DELETE","path":"/v1/edr/iocs","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"ids","in":"query","required":false,"schemaId":"schema_2"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/iocs","href":"edr/edr_delete_iocs","openApiOperationId":"edr_delete_iocs","summary":"Delete IOCs"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/DeleteIocsResponse"}},"schemaId":"components/schemas/DeleteIocsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1iocs/delete/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/DeleteIocsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/DeleteIocsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_delete_iocs"}],"panels":[]}]},"httpPath":"/v1/edr/iocs"},{"label":"Query IOAs","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_query_ioa","routeSlug":"/api-reference/connectors/edr/edr_query_ioa","metadata":{"seo":{"title":"Query IOAs","description":"Returns a list of IOA rules that match the query from the token-linked EDR source."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_query_ioa","name":"Query IOAs","isWebhook":false,"pointer":"/paths/~1v1~1edr~1ioas/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query IOAs","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of IOA rules that match the query from the token-linked EDR source."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_query_ioa"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of IOA rules to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/edr/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the EDR in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1edr~1ioas/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/edr/ioas","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/ioas","href":"edr/edr_query_ioa","openApiOperationId":"edr_query_ioa","summary":"Query IOAs"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryIoaResponse"}},"schemaId":"components/schemas/QueryIoaResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1ioas/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryIoaResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryIoaResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_query_ioa"}],"panels":[]}]},"httpPath":"/v1/edr/ioas"},{"label":"Create IOA","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_create_ioa","routeSlug":"/api-reference/connectors/edr/edr_create_ioa","metadata":{"seo":{"title":"Create IOA","description":"Creates an IOA rule for the token-linked EDR source."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_create_ioa","name":"Create IOA","isWebhook":false,"pointer":"/paths/~1v1~1edr~1ioas/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Create IOA","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Creates an IOA rule for the token-linked EDR source."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_create_ioa"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateIoaRequest"}},"schemaId":"components/schemas/CreateIoaRequest","pointer":"/paths/~1v1~1edr~1ioas/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/edr/ioas","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/CreateIoaRequest"}},"responseCodes":["200","400","401","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/ioas","href":"edr/edr_create_ioa","openApiOperationId":"edr_create_ioa","summary":"Create IOA"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/CreateIoaRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateIoaRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateIoaResponse"}},"schemaId":"components/schemas/CreateIoaResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1ioas/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/CreateIoaResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateIoaResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_create_ioa"}],"panels":[]}]},"httpPath":"/v1/edr/ioas"},{"label":"Delete IOAs","deprecated":false,"httpVerb":"delete","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_delete_ioa","routeSlug":"/api-reference/connectors/edr/edr_delete_ioa","metadata":{"seo":{"title":"Delete IOAs","description":"Deletes the IOA rules identified by the ids in the query params. Some providers scope rule ids to a rule group; for those providers group_id is required."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_delete_ioa","name":"Delete IOAs","isWebhook":false,"pointer":"/paths/~1v1~1edr~1ioas/delete","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Delete IOAs","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Deletes the IOA rules identified by the ids in the query params. Some providers scope rule ids to a rule group; for those providers "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"group_id"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is required."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_delete_ioa"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"ids","in":"query","schemaId":"schema_2","description":"Comma-separated list of IOA rule ids to delete."},{"name":"group_id","in":"query","schemaId":"schema_2","description":"The id of the provider rule group containing the rules. Required by providers that scope rule ids to a rule group (for example CrowdStrike)."}],"pointer":"/paths/~1v1~1edr~1ioas/delete/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"DELETE","path":"/v1/edr/ioas","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"ids","in":"query","required":false,"schemaId":"schema_2"},{"name":"group_id","in":"query","required":false,"schemaId":"schema_2"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/ioas","href":"edr/edr_delete_ioa","openApiOperationId":"edr_delete_ioa","summary":"Delete IOAs"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/DeleteIoaResponse"}},"schemaId":"components/schemas/DeleteIoaResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1ioas/delete/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/DeleteIoaResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/DeleteIoaResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_delete_ioa"}],"panels":[]}]},"httpPath":"/v1/edr/ioas"},{"label":"Query Exclusions","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_query_exclusions","routeSlug":"/api-reference/connectors/edr/edr_query_exclusions","metadata":{"seo":{"title":"Query Exclusions","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_query_exclusions","name":"Query Exclusions","isWebhook":false,"pointer":"/paths/~1v1~1edr~1exclusions/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Exclusions","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the exclusions configured in the token-linked EDR source as OCSF Compliance Findings, one per exclusion rule, with the rule's pattern, match type and scope. The filters a provider accepts, and which rules it returns when a filter is omitted, are described in that provider's filter documentation."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_query_exclusions"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of exclusions to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"created_time[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"created_time"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in descending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/edr/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the EDR in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1edr~1exclusions/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/edr/exclusions","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/exclusions","href":"edr/edr_query_exclusions","openApiOperationId":"edr_query_exclusions","summary":"Query Exclusions"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryExclusionsResponse"}},"schemaId":"components/schemas/QueryExclusionsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1exclusions/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryExclusionsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryExclusionsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_query_exclusions"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/edr/exclusions"},{"label":"Query Policies","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_query_policies","routeSlug":"/api-reference/connectors/edr/edr_query_policies","metadata":{"seo":{"title":"Query Policies","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_query_policies","name":"Query Policies","isWebhook":false,"pointer":"/paths/~1v1~1edr~1policies/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Policies","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the protection policies configured in the token-linked EDR source as OCSF Compliance Findings, one per policy or policy scope, with each recommended setting as an assessment and the vendor policy setting that decided it. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"resource.type"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" selects the policies to evaluate; its values and default are described in each provider's filter documentation."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_query_policies"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of findings to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"created_time[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"created_time"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in descending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/edr/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the EDR in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1edr~1policies/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/edr/policies","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/policies","href":"edr/edr_query_policies","openApiOperationId":"edr_query_policies","summary":"Query Policies"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryPoliciesResponse"}},"schemaId":"components/schemas/QueryPoliciesResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1policies/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryPoliciesResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryPoliciesResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_query_policies"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/edr/policies"},{"label":"Query Posture Score","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_query_posture_score","routeSlug":"/api-reference/connectors/edr/edr_query_posture_score","metadata":{"seo":{"title":"Query Posture Score","description":"Returns the posture score of the endpoint assets that match the query from the token-linked EDR source."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_query_posture_score","name":"Query Posture Score","isWebhook":false,"pointer":"/paths/~1v1~1edr~1posture_score/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Posture Score","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the posture score of the endpoint assets that match the query from the token-linked EDR source."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_query_posture_score"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of scores for endpoints to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/edr/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the EDR in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1edr~1posture_score/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/edr/posture_score","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","500"],"pointer":"/v1/edr/posture_score","href":"edr/edr_query_posture_score","openApiOperationId":"edr_query_posture_score","summary":"Query Posture Score"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryPostureScoreResponse"}},"schemaId":"components/schemas/QueryPostureScoreResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1posture_score/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryPostureScoreResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryPostureScoreResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_query_posture_score"}],"panels":[]}]},"httpPath":"/v1/edr/posture_score"},{"label":"Query EDR Events","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_query_edr_events","routeSlug":"/api-reference/connectors/edr/edr_query_edr_events","metadata":{"seo":{"title":"Query EDR Events","description":"Returns a list of EDR events that match the query from the token-linked EDR source."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_query_edr_events","name":"Query EDR Events","isWebhook":false,"pointer":"/paths/~1v1~1edr~1edr_events/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query EDR Events","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of EDR events that match the query from the token-linked EDR source."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_query_edr_events"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"passthrough-param","in":"query","schemaId":"schema_0","description":"Provider-specific query to pass through to the EDR. This is useful for advanced queries that require additional filtering."},{"name":"filter","in":"query","schemaId":"schema_0","description":"Filter events. Multiple filters can be provided."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the EDR in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of events to return. Defaults to 50."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. To control the direction of the sorting, append"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"timestamp[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"timestamp"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."}],"pointer":"/paths/~1v1~1edr~1edr_events/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/edr/edr_events","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"passthrough-param","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/edr_events","href":"edr/edr_query_edr_events","openApiOperationId":"edr_query_edr_events","summary":"Query EDR Events"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryEdrEventsResponse"}},"schemaId":"components/schemas/QueryEdrEventsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1edr_events/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryEdrEventsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryEdrEventsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_query_edr_events"}],"panels":[]}]},"httpPath":"/v1/edr/edr_events"},{"label":"Get Threat Notes","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_get_threat_notes","routeSlug":"/api-reference/connectors/edr/edr_get_threat_notes","metadata":{"seo":{"title":"Get Threat Notes","description":"Returns a list of notes for a threat."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_get_threat_notes","name":"Get Threat Notes","isWebhook":false,"pointer":"/paths/~1v1~1edr~1threats~1{threatId}~1notes/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Threat Notes","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of notes for a threat."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_get_threat_notes"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"threatId","in":"path","schemaId":"schema_9","required":true}],"pointer":"/paths/~1v1~1edr~1threats~1{threatId}~1notes/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Maximum number of notes to return. Defaults to 100."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Cursor from a previous response to retrieve the next page of notes."}],"pointer":"/paths/~1v1~1edr~1threats~1{threatId}~1notes/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/edr/threats/{threatId}/notes","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"threatId","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/threats/{threatId}/notes","href":"edr/edr_get_threat_notes","openApiOperationId":"edr_get_threat_notes","summary":"Get Threat Notes"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetThreatNotesResponse"}},"schemaId":"components/schemas/GetThreatNotesResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1threats~1{threatId}~1notes/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetThreatNotesResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetThreatNotesResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_get_threat_notes"}],"panels":[]}]},"httpPath":"/v1/edr/threats/{threatId}/notes"},{"label":"Create Threat Note","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/edr/edr_create_threat_note","routeSlug":"/api-reference/connectors/edr/edr_create_threat_note","metadata":{"seo":{"title":"Create Threat Note","description":"Creates a note for a threat."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"edr_create_threat_note","name":"Create Threat Note","isWebhook":false,"pointer":"/paths/~1v1~1edr~1threats~1{threatId}~1notes/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Create Threat Note","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Creates a note for a threat."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"edr_create_threat_note"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"threatId","in":"path","schemaId":"schema_9","required":true}],"pointer":"/paths/~1v1~1edr~1threats~1{threatId}~1notes/post/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1edr~1threats~1{threatId}~1notes/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateThreatNoteRequest"}},"schemaId":"components/schemas/CreateThreatNoteRequest","pointer":"/paths/~1v1~1edr~1threats~1{threatId}~1notes/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/edr/threats/{threatId}/notes","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"threatId","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/CreateThreatNoteRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/edr/threats/{threatId}/notes","href":"edr/edr_create_threat_note","openApiOperationId":"edr_create_threat_note","summary":"Create Threat Note"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/CreateThreatNoteRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateThreatNoteRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateThreatNoteResponse"}},"schemaId":"components/schemas/CreateThreatNoteResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1edr~1threats~1{threatId}~1notes/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/CreateThreatNoteResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateThreatNoteResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/edr/edr_create_threat_note"}],"panels":[]}]},"httpPath":"/v1/edr/threats/{threatId}/notes"}],"content":{"contentType":"group","meta":{"name":"Edr"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Endpoint Detection & Response (EDR)","showPageActions":true}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/edr/endpoints","summary":"Query Endpoints","prefix":{"name":"get","color":"get"},"badges":[],"link":"/edr/edr_query_endpoints","deprecated":false},{"title":"/v1/edr/endpoints/{id}","summary":"Get Endpoint","prefix":{"name":"get","color":"get"},"badges":[],"link":"/edr/edr_get_endpoint","deprecated":false},{"title":"/v1/edr/endpoints/{uid}/actions/execute-command","summary":"Execute Command","prefix":{"name":"post","color":"post"},"badges":[],"link":"/edr/edr_execute_command","deprecated":false},{"title":"/v1/edr/endpoints/{uid}/actions/execute-remote-script","summary":"Execute Remote Script","prefix":{"name":"post","color":"post"},"badges":[],"link":"/edr/edr_execute_remote_script","deprecated":false},{"title":"/v1/edr/endpoints/{uid}/actions/retrieve-file","summary":"Retrieve File","prefix":{"name":"post","color":"post"},"badges":[],"link":"/edr/edr_retrieve_file","deprecated":false},{"title":"/v1/edr/applications","summary":"Query Applications","prefix":{"name":"get","color":"get"},"badges":[],"link":"/edr/edr_query_applications","deprecated":false},{"title":"/v1/edr/endpoints/actions/quarantine","summary":"Quarantine Endpoints","prefix":{"name":"post","color":"post"},"badges":[],"link":"/edr/edr_network_quarantine","deprecated":false},{"title":"/v1/edr/threats","summary":"Query Threat Events","prefix":{"name":"get","color":"get"},"badges":[],"link":"/edr/edr_query_threatevents","deprecated":false},{"title":"/v1/edr/alerts","summary":"Query Alerts","prefix":{"name":"get","color":"get"},"badges":[],"link":"/edr/edr_query_alerts","deprecated":false},{"title":"/v1/edr/alerts/{alertId}","summary":"Update Alert","prefix":{"name":"post","color":"post"},"badges":[],"link":"/edr/edr_update_alert","deprecated":false},{"title":"/v1/edr/iocs","summary":"Query IOCs","prefix":{"name":"get","color":"get"},"badges":[],"link":"/edr/edr_query_iocs","deprecated":false},{"title":"/v1/edr/iocs","summary":"Create IOCs","prefix":{"name":"post","color":"post"},"badges":[],"link":"/edr/edr_create_iocs","deprecated":false},{"title":"/v1/edr/iocs","summary":"Delete IOCs","prefix":{"name":"delete","color":"delete"},"badges":[],"link":"/edr/edr_delete_iocs","deprecated":false},{"title":"/v1/edr/ioas","summary":"Query IOAs","prefix":{"name":"get","color":"get"},"badges":[],"link":"/edr/edr_query_ioa","deprecated":false},{"title":"/v1/edr/ioas","summary":"Create IOA","prefix":{"name":"post","color":"post"},"badges":[],"link":"/edr/edr_create_ioa","deprecated":false},{"title":"/v1/edr/ioas","summary":"Delete IOAs","prefix":{"name":"delete","color":"delete"},"badges":[],"link":"/edr/edr_delete_ioa","deprecated":false},{"title":"/v1/edr/exclusions","summary":"Query Exclusions","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/edr/edr_query_exclusions","deprecated":false},{"title":"/v1/edr/policies","summary":"Query Policies","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/edr/edr_query_policies","deprecated":false},{"title":"/v1/edr/posture_score","summary":"Query Posture Score","prefix":{"name":"get","color":"get"},"badges":[],"link":"/edr/edr_query_posture_score","deprecated":false},{"title":"/v1/edr/edr_events","summary":"Query EDR Events","prefix":{"name":"get","color":"get"},"badges":[],"link":"/edr/edr_query_edr_events","deprecated":false},{"title":"/v1/edr/threats/{threatId}/notes","summary":"Get Threat Notes","prefix":{"name":"get","color":"get"},"badges":[],"link":"/edr/edr_get_threat_notes","deprecated":false},{"title":"/v1/edr/threats/{threatId}/notes","summary":"Create Threat Note","prefix":{"name":"post","color":"post"},"badges":[],"link":"/edr/edr_create_threat_note","deprecated":false}]}]}]}]}},{"type":"group","label":"Email Security","link":"/api-reference/connectors/emailsecurity","routeSlug":"/api-reference/connectors/emailsecurity","items":[{"label":"Query Threats","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/emailsecurity/emailsecurity_query_threats","routeSlug":"/api-reference/connectors/emailsecurity/emailsecurity_query_threats","metadata":{"seo":{"title":"Query Threats","description":"Returns a list of threats matching the query from the token-linked Email Security provider. Defaults to the last 30 days of threats. This can be overridden by using the time filter. Note that some providers may have a maximum time range limit. A threat is an automated detection that was deemed to be a threat by the Email Security provider."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"emailsecurity_query_threats","name":"Query Threats","isWebhook":false,"pointer":"/paths/~1v1~1email-security~1threats/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Threats","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of threats matching the query from the token-linked Email Security provider. Defaults to the last 30 days of threats. This can be overridden by using the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" filter. Note that some providers may have a maximum time range limit. A threat is an automated detection that was deemed to be a threat by the Email Security provider."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"emailsecurity_query_threats"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of threats to return. Defaults to 1000 with a maximum of 5000. If a provider has a maximum limit lower than 5000, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/emailsecurity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."}],"pointer":"/paths/~1v1~1email-security~1threats/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/email-security/threats","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/email-security/threats","href":"emailsecurity/emailsecurity_query_threats","openApiOperationId":"emailsecurity_query_threats","summary":"Query Threats"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/EmailSecurityQueryThreatsResponse"}},"schemaId":"components/schemas/EmailSecurityQueryThreatsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1email-security~1threats/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/EmailSecurityQueryThreatsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/EmailSecurityQueryThreatsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/emailsecurity/emailsecurity_query_threats"}],"panels":[]}]},"httpPath":"/v1/email-security/threats"},{"label":"Get Threat Details","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/emailsecurity/emailsecurity_get_threat_details","routeSlug":"/api-reference/connectors/emailsecurity/emailsecurity_get_threat_details","metadata":{"seo":{"title":"Get Threat Details","description":"Returns the details of the threat matching {threatId} from the token-linked Email Security provider. If a provider allows for the gathering of more detailed information about a threat, the response will include the additional information. Otherwise, the response will only include the basic information about the threat returned by the query_threats endpoint."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"emailsecurity_get_threat_details","name":"Get Threat Details","isWebhook":false,"pointer":"/paths/~1v1~1email-security~1threats~1{threatId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Threat Details","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the details of the threat matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{threatId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from the token-linked Email Security provider. If a provider allows for the gathering of more detailed information about a threat, the response will include the additional information. Otherwise, the response will only include the basic information about the threat returned by the query_threats endpoint."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"emailsecurity_get_threat_details"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"threatId","in":"path","schemaId":"schema_13","required":true}],"pointer":"/paths/~1v1~1email-security~1threats~1{threatId}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1email-security~1threats~1{threatId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/email-security/threats/{threatId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"threatId","in":"path","required":true,"schemaId":"components/schemas/ApplicationId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/email-security/threats/{threatId}","href":"emailsecurity/emailsecurity_get_threat_details","openApiOperationId":"emailsecurity_get_threat_details","summary":"Get Threat Details"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/EmailSecurityGetThreatDetailsResponse"}},"schemaId":"components/schemas/EmailSecurityGetThreatDetailsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1email-security~1threats~1{threatId}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/EmailSecurityGetThreatDetailsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/EmailSecurityGetThreatDetailsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/emailsecurity/emailsecurity_get_threat_details"}],"panels":[]}]},"httpPath":"/v1/email-security/threats/{threatId}"},{"label":"Query Email Events","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/emailsecurity/emailsecurity_query_email_events","routeSlug":"/api-reference/connectors/emailsecurity/emailsecurity_query_email_events","metadata":{"seo":{"title":"Query Email Events","description":"Returns a list of email events matching the query from the token-linked Email Security provider. Most providers default to the last 30 days of email events, which the time filter overrides. Others use a different default range or filter on a different time field, so refer to the provider's declared filters. Some providers also limit the maximum time range."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"emailsecurity_query_email_events","name":"Query Email Events","isWebhook":false,"pointer":"/paths/~1v1~1email-security~1email-events/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Email Events","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of email events matching the query from the token-linked Email Security provider. Most providers default to the last 30 days of email events, which the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" filter overrides. Others use a different default range or filter on a different time field, so refer to the provider's declared filters. Some providers also limit the maximum time range."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"emailsecurity_query_email_events"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of email events to return. Defaults to 1000 with a maximum of 5000. If a provider has a maximum limit lower than 5000, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/emailsecurity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."}],"pointer":"/paths/~1v1~1email-security~1email-events/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/email-security/email-events","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/email-security/email-events","href":"emailsecurity/emailsecurity_query_email_events","openApiOperationId":"emailsecurity_query_email_events","summary":"Query Email Events"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/EmailSecurityQueryEmailEventsResponse"}},"schemaId":"components/schemas/EmailSecurityQueryEmailEventsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1email-security~1email-events/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/EmailSecurityQueryEmailEventsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/EmailSecurityQueryEmailEventsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/emailsecurity/emailsecurity_query_email_events"}],"panels":[]}]},"httpPath":"/v1/email-security/email-events"}],"content":{"contentType":"group","meta":{"name":"Emailsecurity"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Email Security","showPageActions":true}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/email-security/threats","summary":"Query Threats","prefix":{"name":"get","color":"get"},"badges":[],"link":"/emailsecurity/emailsecurity_query_threats","deprecated":false},{"title":"/v1/email-security/threats/{threatId}","summary":"Get Threat Details","prefix":{"name":"get","color":"get"},"badges":[],"link":"/emailsecurity/emailsecurity_get_threat_details","deprecated":false},{"title":"/v1/email-security/email-events","summary":"Query Email Events","prefix":{"name":"get","color":"get"},"badges":[],"link":"/emailsecurity/emailsecurity_query_email_events","deprecated":false}]}]}]}]}},{"type":"group","label":"Endpoint Management","link":"/api-reference/connectors/endpointmanagement","routeSlug":"/api-reference/connectors/endpointmanagement","items":[{"label":"Query Devices","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/endpointmanagement/endpointmanagement_query_devices","routeSlug":"/api-reference/connectors/endpointmanagement/endpointmanagement_query_devices","metadata":{"seo":{"title":"Query Devices","description":"Returns a list of managed devices matching the query from the token-linked endpoint management source."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"endpointmanagement_query_devices","name":"Query Devices","isWebhook":false,"pointer":"/paths/~1v1~1endpoint-management~1devices/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Devices","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of managed devices matching the query from the token-linked endpoint management source."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"endpointmanagement_query_devices"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of devices to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"device.name[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"device.name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/endpointmanagement/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1endpoint-management~1devices/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/endpoint-management/devices","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/endpoint-management/devices","href":"endpointmanagement/endpointmanagement_query_devices","openApiOperationId":"endpointmanagement_query_devices","summary":"Query Devices"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryEndpointManagementDevicesResponse"}},"schemaId":"components/schemas/QueryEndpointManagementDevicesResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1endpoint-management~1devices/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryEndpointManagementDevicesResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryEndpointManagementDevicesResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/endpointmanagement/endpointmanagement_query_devices"}],"panels":[]}]},"httpPath":"/v1/endpoint-management/devices"},{"label":"Get Device","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/endpointmanagement/endpointmanagement_get_device","routeSlug":"/api-reference/connectors/endpointmanagement/endpointmanagement_get_device","metadata":{"seo":{"title":"Get Device","description":"Gets a single managed device matching the ID from the token-linked endpoint management source."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"endpointmanagement_get_device","name":"Get Device","isWebhook":false,"pointer":"/paths/~1v1~1endpoint-management~1devices~1{id}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Device","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Gets a single managed device matching the ID from the token-linked endpoint management source."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"endpointmanagement_get_device"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"id","in":"path","schemaId":"schema_13","required":true}],"pointer":"/paths/~1v1~1endpoint-management~1devices~1{id}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1endpoint-management~1devices~1{id}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/endpoint-management/devices/{id}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"id","in":"path","required":true,"schemaId":"components/schemas/ApplicationId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/endpoint-management/devices/{id}","href":"endpointmanagement/endpointmanagement_get_device","openApiOperationId":"endpointmanagement_get_device","summary":"Get Device"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetEndpointManagementDeviceResponse"}},"schemaId":"components/schemas/GetEndpointManagementDeviceResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1endpoint-management~1devices~1{id}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetEndpointManagementDeviceResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetEndpointManagementDeviceResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/endpointmanagement/endpointmanagement_get_device"}],"panels":[]}]},"httpPath":"/v1/endpoint-management/devices/{id}"},{"label":"Query Device Compliance","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/endpointmanagement/endpointmanagement_query_compliance_findings","routeSlug":"/api-reference/connectors/endpointmanagement/endpointmanagement_query_compliance_findings","metadata":{"seo":{"title":"Query Device Compliance","description":"Returns a list of device compliance findings matching the query from the token-linked endpoint management source."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"endpointmanagement_query_compliance_findings","name":"Query Device Compliance","isWebhook":false,"pointer":"/paths/~1v1~1endpoint-management~1compliance/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Device Compliance","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of device compliance findings matching the query from the token-linked endpoint management source."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"endpointmanagement_query_compliance_findings"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of compliance findings to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/endpointmanagement/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1endpoint-management~1compliance/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/endpoint-management/compliance","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/endpoint-management/compliance","href":"endpointmanagement/endpointmanagement_query_compliance_findings","openApiOperationId":"endpointmanagement_query_compliance_findings","summary":"Query Device Compliance"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryDeviceComplianceResponse"}},"schemaId":"components/schemas/QueryDeviceComplianceResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1endpoint-management~1compliance/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryDeviceComplianceResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryDeviceComplianceResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/endpointmanagement/endpointmanagement_query_compliance_findings"}],"panels":[]}]},"httpPath":"/v1/endpoint-management/compliance"},{"label":"Remediate Device","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/endpointmanagement/endpointmanagement_remediate_device","routeSlug":"/api-reference/connectors/endpointmanagement/endpointmanagement_remediate_device","metadata":{"seo":{"title":"Remediate Device","description":"Performs a remediation action on a managed device from the token-linked endpoint management source."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"endpointmanagement_remediate_device","name":"Remediate Device","isWebhook":false,"pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1remediate/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Remediate Device","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Performs a remediation action on a managed device from the token-linked endpoint management source."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"endpointmanagement_remediate_device"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1remediate/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/RemediationRequest"}},"schemaId":"components/schemas/RemediationRequest","pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1remediate/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/endpoint-management/devices/actions/remediate","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/RemediationRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/endpoint-management/devices/actions/remediate","href":"endpointmanagement/endpointmanagement_remediate_device","openApiOperationId":"endpointmanagement_remediate_device","summary":"Remediate Device"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/RemediationRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/RemediationRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/RemediateDeviceResponse"}},"schemaId":"components/schemas/RemediateDeviceResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1remediate/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/RemediateDeviceResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/RemediateDeviceResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/endpointmanagement/endpointmanagement_remediate_device"}],"panels":[]}]},"httpPath":"/v1/endpoint-management/devices/actions/remediate"},{"label":"Update Device","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/endpointmanagement/endpointmanagement_update_device","routeSlug":"/api-reference/connectors/endpointmanagement/endpointmanagement_update_device","metadata":{"seo":{"title":"Update Device","description":"Triggers the device to check in and enforce all assigned policies, profiles, and pending updates."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"endpointmanagement_update_device","name":"Update Device","isWebhook":false,"pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1update/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Update Device","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Triggers the device to check in and enforce all assigned policies, profiles, and pending updates."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"endpointmanagement_update_device"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1update/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/DeviceActionRequestBody"}},"schemaId":"components/schemas/DeviceActionRequestBody","pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1update/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/endpoint-management/devices/actions/update","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/DeviceActionRequestBody"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/endpoint-management/devices/actions/update","href":"endpointmanagement/endpointmanagement_update_device","openApiOperationId":"endpointmanagement_update_device","summary":"Update Device"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/DeviceActionRequestBody","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/DeviceActionRequestBody"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/DeviceActionResponse"}},"schemaId":"components/schemas/DeviceActionResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1update/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/DeviceActionResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/DeviceActionResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/endpointmanagement/endpointmanagement_update_device"}],"panels":[]}]},"httpPath":"/v1/endpoint-management/devices/actions/update"},{"label":"Lock Device","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/endpointmanagement/endpointmanagement_lock_device","routeSlug":"/api-reference/connectors/endpointmanagement/endpointmanagement_lock_device","metadata":{"seo":{"title":"Lock Device","description":"Remotely locks the device screen."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"endpointmanagement_lock_device","name":"Lock Device","isWebhook":false,"pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1lock/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Lock Device","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Remotely locks the device screen."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"endpointmanagement_lock_device"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1lock/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/DeviceActionRequestBody"}},"schemaId":"components/schemas/DeviceActionRequestBody","pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1lock/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/endpoint-management/devices/actions/lock","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/DeviceActionRequestBody"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/endpoint-management/devices/actions/lock","href":"endpointmanagement/endpointmanagement_lock_device","openApiOperationId":"endpointmanagement_lock_device","summary":"Lock Device"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/DeviceActionRequestBody","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/DeviceActionRequestBody"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/DeviceActionResponse"}},"schemaId":"components/schemas/DeviceActionResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1lock/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/DeviceActionResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/DeviceActionResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/endpointmanagement/endpointmanagement_lock_device"}],"panels":[]}]},"httpPath":"/v1/endpoint-management/devices/actions/lock"},{"label":"Restart Device","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/endpointmanagement/endpointmanagement_restart_device","routeSlug":"/api-reference/connectors/endpointmanagement/endpointmanagement_restart_device","metadata":{"seo":{"title":"Restart Device","description":"Remotely reboots the device."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"endpointmanagement_restart_device","name":"Restart Device","isWebhook":false,"pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1restart/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Restart Device","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Remotely reboots the device."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"endpointmanagement_restart_device"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1restart/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/DeviceActionRequestBody"}},"schemaId":"components/schemas/DeviceActionRequestBody","pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1restart/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/endpoint-management/devices/actions/restart","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/DeviceActionRequestBody"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/endpoint-management/devices/actions/restart","href":"endpointmanagement/endpointmanagement_restart_device","openApiOperationId":"endpointmanagement_restart_device","summary":"Restart Device"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/DeviceActionRequestBody","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/DeviceActionRequestBody"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/DeviceActionResponse"}},"schemaId":"components/schemas/DeviceActionResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1restart/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/DeviceActionResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/DeviceActionResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/endpointmanagement/endpointmanagement_restart_device"}],"panels":[]}]},"httpPath":"/v1/endpoint-management/devices/actions/restart"},{"label":"Wipe Device","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/endpointmanagement/endpointmanagement_wipe_device","routeSlug":"/api-reference/connectors/endpointmanagement/endpointmanagement_wipe_device","metadata":{"seo":{"title":"Wipe Device","description":"Factory resets or erases all data from the device."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"endpointmanagement_wipe_device","name":"Wipe Device","isWebhook":false,"pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1wipe/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Wipe Device","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Factory resets or erases all data from the device."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"endpointmanagement_wipe_device"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1wipe/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/DeviceActionRequestBody"}},"schemaId":"components/schemas/DeviceActionRequestBody","pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1wipe/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/endpoint-management/devices/actions/wipe","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/DeviceActionRequestBody"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/endpoint-management/devices/actions/wipe","href":"endpointmanagement/endpointmanagement_wipe_device","openApiOperationId":"endpointmanagement_wipe_device","summary":"Wipe Device"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/DeviceActionRequestBody","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/DeviceActionRequestBody"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/DeviceActionResponse"}},"schemaId":"components/schemas/DeviceActionResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1endpoint-management~1devices~1actions~1wipe/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/DeviceActionResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/DeviceActionResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/endpointmanagement/endpointmanagement_wipe_device"}],"panels":[]}]},"httpPath":"/v1/endpoint-management/devices/actions/wipe"},{"label":"Query Device Applications","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/endpointmanagement/endpointmanagement_query_device_applications","routeSlug":"/api-reference/connectors/endpointmanagement/endpointmanagement_query_device_applications","metadata":{"seo":{"title":"Query Device Applications","description":"Returns a list of applications installed on a managed device from the token-linked endpoint management source."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"endpointmanagement_query_device_applications","name":"Query Device Applications","isWebhook":false,"pointer":"/paths/~1v1~1endpoint-management~1devices~1{id}~1applications/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Device Applications","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of applications installed on a managed device from the token-linked endpoint management source."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"endpointmanagement_query_device_applications"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"id","in":"path","schemaId":"schema_13","required":true}],"pointer":"/paths/~1v1~1endpoint-management~1devices~1{id}~1applications/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of applications to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"product.name[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"product.name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/endpointmanagement/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1endpoint-management~1devices~1{id}~1applications/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/endpoint-management/devices/{id}/applications","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"id","in":"path","required":true,"schemaId":"components/schemas/ApplicationId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/endpoint-management/devices/{id}/applications","href":"endpointmanagement/endpointmanagement_query_device_applications","openApiOperationId":"endpointmanagement_query_device_applications","summary":"Query Device Applications"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryDeviceApplicationsResponse"}},"schemaId":"components/schemas/QueryDeviceApplicationsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1endpoint-management~1devices~1{id}~1applications/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryDeviceApplicationsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryDeviceApplicationsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/endpointmanagement/endpointmanagement_query_device_applications"}],"panels":[]}]},"httpPath":"/v1/endpoint-management/devices/{id}/applications"}],"content":{"contentType":"group","meta":{"name":"Endpointmanagement"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Endpoint Management","showPageActions":true}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/endpoint-management/devices","summary":"Query Devices","prefix":{"name":"get","color":"get"},"badges":[],"link":"/endpointmanagement/endpointmanagement_query_devices","deprecated":false},{"title":"/v1/endpoint-management/devices/{id}","summary":"Get Device","prefix":{"name":"get","color":"get"},"badges":[],"link":"/endpointmanagement/endpointmanagement_get_device","deprecated":false},{"title":"/v1/endpoint-management/compliance","summary":"Query Device Compliance","prefix":{"name":"get","color":"get"},"badges":[],"link":"/endpointmanagement/endpointmanagement_query_compliance_findings","deprecated":false},{"title":"/v1/endpoint-management/devices/actions/remediate","summary":"Remediate Device","prefix":{"name":"post","color":"post"},"badges":[],"link":"/endpointmanagement/endpointmanagement_remediate_device","deprecated":false},{"title":"/v1/endpoint-management/devices/actions/update","summary":"Update Device","prefix":{"name":"post","color":"post"},"badges":[],"link":"/endpointmanagement/endpointmanagement_update_device","deprecated":false},{"title":"/v1/endpoint-management/devices/actions/lock","summary":"Lock Device","prefix":{"name":"post","color":"post"},"badges":[],"link":"/endpointmanagement/endpointmanagement_lock_device","deprecated":false},{"title":"/v1/endpoint-management/devices/actions/restart","summary":"Restart Device","prefix":{"name":"post","color":"post"},"badges":[],"link":"/endpointmanagement/endpointmanagement_restart_device","deprecated":false},{"title":"/v1/endpoint-management/devices/actions/wipe","summary":"Wipe Device","prefix":{"name":"post","color":"post"},"badges":[],"link":"/endpointmanagement/endpointmanagement_wipe_device","deprecated":false},{"title":"/v1/endpoint-management/devices/{id}/applications","summary":"Query Device Applications","prefix":{"name":"get","color":"get"},"badges":[],"link":"/endpointmanagement/endpointmanagement_query_device_applications","deprecated":false}]}]}]}]}},{"type":"group","label":"Governance, Risk, & Compliance (GRC) (In Development)","link":"/api-reference/connectors/grc","routeSlug":"/api-reference/connectors/grc","items":[{"label":"Query Frameworks","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/grc/grc_query_frameworks","routeSlug":"/api-reference/connectors/grc/grc_query_frameworks","metadata":{"seo":{"title":"Query Frameworks","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"grc_query_frameworks","name":"Query Frameworks","isWebhook":false,"pointer":"/paths/~1v1~1grc~1frameworks/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Frameworks","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the compliance frameworks tracked in the token-linked GRC integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"grc_query_frameworks"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of frameworks to return. Defaults to 100."},{"name":"order","in":"query","schemaId":"schema_0","description":"Ordering is not supported for frameworks in v1."},{"name":"filter","in":"query","schemaId":"schema_0","description":"Filtering is not supported for frameworks in v1."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1grc~1frameworks/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/grc/frameworks","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/grc/frameworks","href":"grc/grc_query_frameworks","openApiOperationId":"grc_query_frameworks","summary":"Query Frameworks"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcQueryFrameworksResponse"}},"schemaId":"components/schemas/GrcQueryFrameworksResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1grc~1frameworks/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GrcQueryFrameworksResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcQueryFrameworksResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/grc/grc_query_frameworks"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/grc/frameworks"},{"label":"Query Controls","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/grc/grc_query_controls","routeSlug":"/api-reference/connectors/grc/grc_query_controls","metadata":{"seo":{"title":"Query Controls","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"grc_query_controls","name":"Query Controls","isWebhook":false,"pointer":"/paths/~1v1~1grc~1controls/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Controls","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the compliance controls defined in the token-linked GRC integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"grc_query_controls"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of controls to return. Defaults to 100."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Order results by a supported field. Ascending by default; append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for descending (or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"). Supported fields vary by provider; consult the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/management/capabilities"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"capabilities API"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for a given provider's coverage."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"field[operator]value"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" clauses using "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"eq"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"/"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"in"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (repeat the parameter to AND clauses together). Supported fields vary by provider; consult the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/management/capabilities"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"capabilities API"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for a given provider's coverage. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/grc/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1grc~1controls/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/grc/controls","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/grc/controls","href":"grc/grc_query_controls","openApiOperationId":"grc_query_controls","summary":"Query Controls"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcQueryControlsResponse"}},"schemaId":"components/schemas/GrcQueryControlsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1grc~1controls/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GrcQueryControlsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcQueryControlsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/grc/grc_query_controls"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/grc/controls"},{"label":"Get GrcControl","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/grc/grc_get_control","routeSlug":"/api-reference/connectors/grc/grc_get_control","metadata":{"seo":{"title":"Get GrcControl","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"grc_get_control","name":"Get GrcControl","isWebhook":false,"pointer":"/paths/~1v1~1grc~1controls~1{controlId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get GrcControl","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the compliance control matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{controlId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from the token-linked GRC integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"grc_get_control"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"controlId","in":"path","schemaId":"schema_14","required":true}],"pointer":"/paths/~1v1~1grc~1controls~1{controlId}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1grc~1controls~1{controlId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/grc/controls/{controlId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"controlId","in":"path","required":true,"schemaId":"schema_15"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/grc/controls/{controlId}","href":"grc/grc_get_control","openApiOperationId":"grc_get_control","summary":"Get GrcControl"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcGetControlResponse"}},"schemaId":"components/schemas/GrcGetControlResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1grc~1controls~1{controlId}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GrcGetControlResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcGetControlResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/grc/grc_get_control"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/grc/controls/{controlId}"},{"label":"Query Tests","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/grc/grc_query_tests","routeSlug":"/api-reference/connectors/grc/grc_query_tests","metadata":{"seo":{"title":"Query Tests","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"grc_query_tests","name":"Query Tests","isWebhook":false,"pointer":"/paths/~1v1~1grc~1tests/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Tests","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the automated compliance tests defined in the token-linked GRC integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"grc_query_tests"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of tests to return. Defaults to 100."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Order results by a supported field. Ascending by default; append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for descending (or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"). Supported fields vary by provider; consult the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/management/capabilities"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"capabilities API"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for a given provider's coverage."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"field[operator]value"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" clauses using "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"eq"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"/"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"in"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (repeat the parameter to AND clauses together). Supported fields vary by provider; consult the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/management/capabilities"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"capabilities API"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for a given provider's coverage. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/grc/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1grc~1tests/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/grc/tests","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/grc/tests","href":"grc/grc_query_tests","openApiOperationId":"grc_query_tests","summary":"Query Tests"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcQueryTestsResponse"}},"schemaId":"components/schemas/GrcQueryTestsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1grc~1tests/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GrcQueryTestsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcQueryTestsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/grc/grc_query_tests"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/grc/tests"},{"label":"Get GrcTest","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/grc/grc_get_test","routeSlug":"/api-reference/connectors/grc/grc_get_test","metadata":{"seo":{"title":"Get GrcTest","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"grc_get_test","name":"Get GrcTest","isWebhook":false,"pointer":"/paths/~1v1~1grc~1tests~1{testId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get GrcTest","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the compliance test matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{testId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from the token-linked GRC integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"grc_get_test"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"testId","in":"path","schemaId":"schema_16","required":true}],"pointer":"/paths/~1v1~1grc~1tests~1{testId}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1grc~1tests~1{testId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/grc/tests/{testId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"testId","in":"path","required":true,"schemaId":"schema_17"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/grc/tests/{testId}","href":"grc/grc_get_test","openApiOperationId":"grc_get_test","summary":"Get GrcTest"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcGetTestResponse"}},"schemaId":"components/schemas/GrcGetTestResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1grc~1tests~1{testId}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GrcGetTestResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcGetTestResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/grc/grc_get_test"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/grc/tests/{testId}"},{"label":"Query GrcEvidence","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/grc/grc_query_evidence","routeSlug":"/api-reference/connectors/grc/grc_query_evidence","metadata":{"seo":{"title":"Query GrcEvidence","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"grc_query_evidence","name":"Query GrcEvidence","isWebhook":false,"pointer":"/paths/~1v1~1grc~1evidence/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query GrcEvidence","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the documentation artifacts collected in the token-linked GRC integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"grc_query_evidence"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of evidence artifacts to return. Defaults to 100."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Order results by a supported field. Ascending by default; append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for descending (or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"). Supported fields vary by provider; consult the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/management/capabilities"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"capabilities API"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for a given provider's coverage."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"field[operator]value"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" clauses using "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"eq"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"/"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"in"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (repeat the parameter to AND clauses together). Supported fields vary by provider; consult the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/management/capabilities"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"capabilities API"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for a given provider's coverage. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/grc/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1grc~1evidence/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/grc/evidence","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/grc/evidence","href":"grc/grc_query_evidence","openApiOperationId":"grc_query_evidence","summary":"Query GrcEvidence"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcQueryEvidenceResponse"}},"schemaId":"components/schemas/GrcQueryEvidenceResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1grc~1evidence/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GrcQueryEvidenceResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcQueryEvidenceResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/grc/grc_query_evidence"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/grc/evidence"},{"label":"Query Devices","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/grc/grc_query_devices","routeSlug":"/api-reference/connectors/grc/grc_query_devices","metadata":{"seo":{"title":"Query Devices","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"grc_query_devices","name":"Query Devices","isWebhook":false,"pointer":"/paths/~1v1~1grc~1devices/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Devices","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the compliance state of every device tracked in the token-linked GRC integration, as OCSF Compliance Findings. Includes compliant devices."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"grc_query_devices"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of devices to return. Defaults to 100."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Order results by a supported field. Ascending by default; append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for descending (or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"). Supported fields vary by provider; consult the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/management/capabilities"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"capabilities API"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for a given provider's coverage."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"field[operator]value"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" clauses using "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"eq"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"/"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"in"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (repeat the parameter to AND clauses together). Supported fields vary by provider; consult the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/management/capabilities"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"capabilities API"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for a given provider's coverage. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/grc/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1grc~1devices/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/grc/devices","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/grc/devices","href":"grc/grc_query_devices","openApiOperationId":"grc_query_devices","summary":"Query Devices"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcQueryDevicesResponse"}},"schemaId":"components/schemas/GrcQueryDevicesResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1grc~1devices/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GrcQueryDevicesResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcQueryDevicesResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/grc/grc_query_devices"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/grc/devices"},{"label":"Get Device","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/grc/grc_get_device","routeSlug":"/api-reference/connectors/grc/grc_get_device","metadata":{"seo":{"title":"Get Device","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"grc_get_device","name":"Get Device","isWebhook":false,"pointer":"/paths/~1v1~1grc~1devices~1{deviceId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Device","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the compliance state of the device matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{deviceId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from the token-linked GRC integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"grc_get_device"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"deviceId","in":"path","schemaId":"schema_18","required":true}],"pointer":"/paths/~1v1~1grc~1devices~1{deviceId}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1grc~1devices~1{deviceId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/grc/devices/{deviceId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"deviceId","in":"path","required":true,"schemaId":"schema_19"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/grc/devices/{deviceId}","href":"grc/grc_get_device","openApiOperationId":"grc_get_device","summary":"Get Device"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcGetDeviceResponse"}},"schemaId":"components/schemas/GrcGetDeviceResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1grc~1devices~1{deviceId}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GrcGetDeviceResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcGetDeviceResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/grc/grc_get_device"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/grc/devices/{deviceId}"},{"label":"Query Personnel","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/grc/grc_query_personnel","routeSlug":"/api-reference/connectors/grc/grc_query_personnel","metadata":{"seo":{"title":"Query Personnel","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"grc_query_personnel","name":"Query Personnel","isWebhook":false,"pointer":"/paths/~1v1~1grc~1personnel/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Personnel","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the compliance state of every person tracked in the token-linked GRC integration, as OCSF Compliance Findings. Includes compliant personnel."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"grc_query_personnel"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of people to return. Defaults to 100."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Order results by a supported field. Ascending by default; append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for descending (or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"). Supported fields vary by provider; consult the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/management/capabilities"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"capabilities API"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for a given provider's coverage."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"field[operator]value"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" clauses using "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"eq"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"/"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"in"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (repeat the parameter to AND clauses together). Supported fields vary by provider; consult the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/management/capabilities"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"capabilities API"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for a given provider's coverage. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/grc/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1grc~1personnel/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/grc/personnel","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/grc/personnel","href":"grc/grc_query_personnel","openApiOperationId":"grc_query_personnel","summary":"Query Personnel"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcQueryPersonnelResponse"}},"schemaId":"components/schemas/GrcQueryPersonnelResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1grc~1personnel/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GrcQueryPersonnelResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcQueryPersonnelResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/grc/grc_query_personnel"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/grc/personnel"},{"label":"Get Personnel","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/grc/grc_get_personnel","routeSlug":"/api-reference/connectors/grc/grc_get_personnel","metadata":{"seo":{"title":"Get Personnel","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"grc_get_personnel","name":"Get Personnel","isWebhook":false,"pointer":"/paths/~1v1~1grc~1personnel~1{personnelId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Personnel","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the compliance state of the person matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{personnelId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from the token-linked GRC integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"grc_get_personnel"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"personnelId","in":"path","schemaId":"schema_20","required":true}],"pointer":"/paths/~1v1~1grc~1personnel~1{personnelId}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1grc~1personnel~1{personnelId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/grc/personnel/{personnelId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"personnelId","in":"path","required":true,"schemaId":"schema_21"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/grc/personnel/{personnelId}","href":"grc/grc_get_personnel","openApiOperationId":"grc_get_personnel","summary":"Get Personnel"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcGetPersonnelResponse"}},"schemaId":"components/schemas/GrcGetPersonnelResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1grc~1personnel~1{personnelId}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GrcGetPersonnelResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GrcGetPersonnelResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/grc/grc_get_personnel"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/grc/personnel/{personnelId}"}],"content":{"contentType":"group","meta":{"name":"Grc"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Governance, Risk, & Compliance (GRC) (In Development)","showPageActions":true},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This feature is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this feature."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"}]}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/grc/frameworks","summary":"Query Frameworks","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/grc/grc_query_frameworks","deprecated":false},{"title":"/v1/grc/controls","summary":"Query Controls","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/grc/grc_query_controls","deprecated":false},{"title":"/v1/grc/controls/{controlId}","summary":"Get GrcControl","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/grc/grc_get_control","deprecated":false},{"title":"/v1/grc/tests","summary":"Query Tests","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/grc/grc_query_tests","deprecated":false},{"title":"/v1/grc/tests/{testId}","summary":"Get GrcTest","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/grc/grc_get_test","deprecated":false},{"title":"/v1/grc/evidence","summary":"Query GrcEvidence","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/grc/grc_query_evidence","deprecated":false},{"title":"/v1/grc/devices","summary":"Query Devices","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/grc/grc_query_devices","deprecated":false},{"title":"/v1/grc/devices/{deviceId}","summary":"Get Device","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/grc/grc_get_device","deprecated":false},{"title":"/v1/grc/personnel","summary":"Query Personnel","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/grc/grc_query_personnel","deprecated":false},{"title":"/v1/grc/personnel/{personnelId}","summary":"Get Personnel","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/grc/grc_get_personnel","deprecated":false}]}]}]}]}},{"type":"group","label":"Hooks","link":"/api-reference/connectors/hooks","routeSlug":"/api-reference/connectors/hooks","items":[{"label":"Proxy Webhook","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/hooks/hooks_proxy","routeSlug":"/api-reference/connectors/hooks/hooks_proxy","metadata":{"seo":{"title":"Proxy Webhook","description":"Proxy webhook messages from webhook providers to webhook recievers. For exact webhook implementations please refer to providers e.g. Ticketing. This is just an API call used in that context, not a standalone implementation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"hooks_proxy","name":"Proxy Webhook","isWebhook":false,"pointer":"/paths/~1v1~1hooks/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Proxy Webhook","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Proxy webhook messages from webhook providers to webhook recievers. For exact webhook implementations please refer to providers e.g. Ticketing. This is just an API call used in that context, not a standalone implementation."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"hooks_proxy"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"token","in":"query","schemaId":"schema_9","description":"Optional: if you can't use the HTTP Authorization Bearer, specify integration access token here.","required":true}],"pointer":"/paths/~1v1~1hooks/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_22"}},"schemaId":"schema_22","pointer":"/paths/~1v1~1hooks/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/hooks","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"token","in":"query","required":true,"schemaId":"schema_9"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"schema_22"}},"responseCodes":["204","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/hooks","href":"hooks/hooks_proxy","openApiOperationId":"hooks_proxy","summary":"Proxy Webhook"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"schema_22","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_22"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1hooks/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"204"},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/hooks/hooks_proxy"}],"panels":[]}]},"httpPath":"/v1/hooks"}],"content":{"contentType":"group","meta":{"name":"Hooks"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Hooks","showPageActions":true}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/hooks","summary":"Proxy Webhook","prefix":{"name":"post","color":"post"},"badges":[],"link":"/hooks/hooks_proxy","deprecated":false}]}]}]}]}},{"type":"group","label":"Identity","link":"/api-reference/connectors/identity","routeSlug":"/api-reference/connectors/identity","items":[{"label":"Query Audit Log","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/identity/identity_query_audit_log","routeSlug":"/api-reference/connectors/identity/identity_query_audit_log","metadata":{"seo":{"title":"Query Audit Log","description":"Returns a list of Event objects from the token-linked audit log."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"identity_query_audit_log","name":"Query Audit Log","isWebhook":false,"pointer":"/paths/~1v1~1identity~1audit/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Audit Log","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Event"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects from the token-linked audit log."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"identity_query_audit_log"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of events to return. Defaults to 100."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/identity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the SIEM in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1identity~1audit/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/identity/audit","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/identity/audit","href":"identity/identity_query_audit_log","openApiOperationId":"identity_query_audit_log","summary":"Query Audit Log"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryIdentityAuditLogResponse"}},"schemaId":"components/schemas/QueryIdentityAuditLogResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1identity~1audit/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryIdentityAuditLogResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryIdentityAuditLogResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/identity/identity_query_audit_log"}],"panels":[]}]},"httpPath":"/v1/identity/audit"},{"label":"Query Risk Events","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/identity/identity_query_risk_events","routeSlug":"/api-reference/connectors/identity/identity_query_risk_events","metadata":{"seo":{"title":"Query Risk Events","description":"Returns identity threat / risk events (for example Microsoft Entra Identity Protection risk detections for users), normalized to OCSF."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"identity_query_risk_events","name":"Query Risk Events","isWebhook":false,"pointer":"/paths/~1v1~1identity~1risk-events/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Risk Events","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns identity threat / risk events (for example Microsoft Entra Identity Protection risk detections for users), normalized to OCSF."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"identity_query_risk_events"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of events to return. Defaults to 100."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/identity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the identity provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1identity~1risk-events/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/identity/risk-events","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/identity/risk-events","href":"identity/identity_query_risk_events","openApiOperationId":"identity_query_risk_events","summary":"Query Risk Events"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryIdentityRiskEventsResponse"}},"schemaId":"components/schemas/QueryIdentityRiskEventsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1identity~1risk-events/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryIdentityRiskEventsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryIdentityRiskEventsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/identity/identity_query_risk_events"}],"panels":[]}]},"httpPath":"/v1/identity/risk-events"},{"label":"Query Risky Users","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/identity/identity_query_risky_users","routeSlug":"/api-reference/connectors/identity/identity_query_risky_users","metadata":{"seo":{"title":"Query Risky Users","description":"Returns rolled-up risky user records (for example Microsoft Entra Identity Protection riskyUsers), each normalized to an OCSF Entity Management Read event."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"identity_query_risky_users","name":"Query Risky Users","isWebhook":false,"pointer":"/paths/~1v1~1identity~1risky-users/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Risky Users","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns rolled-up risky user records (for example Microsoft Entra Identity Protection riskyUsers), each normalized to an OCSF Entity Management Read event."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"identity_query_risky_users"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of users to return. Defaults to 100."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/identity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the identity provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1identity~1risky-users/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/identity/risky-users","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/identity/risky-users","href":"identity/identity_query_risky_users","openApiOperationId":"identity_query_risky_users","summary":"Query Risky Users"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryIdentityRiskyUsersResponse"}},"schemaId":"components/schemas/QueryIdentityRiskyUsersResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1identity~1risky-users/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryIdentityRiskyUsersResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryIdentityRiskyUsersResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/identity/identity_query_risky_users"}],"panels":[]}]},"httpPath":"/v1/identity/risky-users"},{"label":"Query Applications","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/identity/identity_query_applications","routeSlug":"/api-reference/connectors/identity/identity_query_applications","metadata":{"seo":{"title":"Query Applications","description":"Returns the applications registered in, or connected to, the identity provider, such as SSO applications, OAuth and OIDC clients, service principals and installed apps, each normalized to an OCSF Application Inventory Info event. A provider that keeps more than one kind of record for an application returns each as its own record, distinguished by application.type."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"identity_query_applications","name":"Query Applications","isWebhook":false,"pointer":"/paths/~1v1~1identity~1applications/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Applications","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the applications registered in, or connected to, the identity provider, such as SSO applications, OAuth and OIDC clients, service principals and installed apps, each normalized to an OCSF Application Inventory Info event. A provider that keeps more than one kind of record for an application returns each as its own record, distinguished by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"application.type"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"identity_query_applications"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of applications to return. Defaults to 100."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to provider order. To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"application.name[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"application.name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/identity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the identity provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1identity~1applications/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/identity/applications","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/identity/applications","href":"identity/identity_query_applications","openApiOperationId":"identity_query_applications","summary":"Query Applications"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryIdentityApplicationsResponse"}},"schemaId":"components/schemas/QueryIdentityApplicationsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1identity~1applications/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryIdentityApplicationsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryIdentityApplicationsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/identity/identity_query_applications"}],"panels":[]}]},"httpPath":"/v1/identity/applications"},{"label":"Query Access Grants","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/identity/identity_query_access_grants","routeSlug":"/api-reference/connectors/identity/identity_query_access_grants","metadata":{"seo":{"title":"Query Access Grants","description":"Returns the standing access that principals hold in the identity provider, normalized to OCSF Access Grant Inventory Info events. A grant is a delegated permission (an application acting on behalf of a signed-in user), an application permission (an application acting as itself), or an assignment (a user, group or application assigned to an application or resource)."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"identity_query_access_grants","name":"Query Access Grants","isWebhook":false,"pointer":"/paths/~1v1~1identity~1access-grants/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Access Grants","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the standing access that principals hold in the identity provider, normalized to OCSF Access Grant Inventory Info events. A grant is a delegated permission (an application acting on behalf of a signed-in user), an application permission (an application acting as itself), or an assignment (a user, group or application assigned to an application or resource)."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"identity_query_access_grants"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of grants to return. Defaults to 100."},{"name":"cursor","in":"query","schemaId":"schema_2","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start search from cursor position. A page may hold fewer than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"limit"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" grants, or none; keep paging until the response carries no cursor."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to provider order. To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"application.uid[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"application.uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/identity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the identity provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1identity~1access-grants/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/identity/access-grants","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/identity/access-grants","href":"identity/identity_query_access_grants","openApiOperationId":"identity_query_access_grants","summary":"Query Access Grants"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryIdentityAccessGrantsResponse"}},"schemaId":"components/schemas/QueryIdentityAccessGrantsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1identity~1access-grants/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryIdentityAccessGrantsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryIdentityAccessGrantsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/identity/identity_query_access_grants"}],"panels":[]}]},"httpPath":"/v1/identity/access-grants"},{"label":"Query Policies","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/identity/identity_query_policies","routeSlug":"/api-reference/connectors/identity/identity_query_policies","metadata":{"seo":{"title":"Query Policies","description":"Returns the authentication, authorization, consent and access policies configured in the token-linked identity provider. Disabled and report-only policies are included."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"identity_query_policies","name":"Query Policies","isWebhook":false,"pointer":"/paths/~1v1~1identity~1policies/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Policies","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the authentication, authorization, consent and access policies configured in the token-linked identity provider. Disabled and report-only policies are included."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"identity_query_policies"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of policies to return. Defaults to 100."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":"Not supported on this endpoint; any value returns 400. Policies are returned in the provider's documented kind order."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/identity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the identity provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1identity~1policies/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/identity/policies","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/identity/policies","href":"identity/identity_query_policies","openApiOperationId":"identity_query_policies","summary":"Query Policies"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryIdentityPoliciesResponse"}},"schemaId":"components/schemas/QueryIdentityPoliciesResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1identity~1policies/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryIdentityPoliciesResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryIdentityPoliciesResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/identity/identity_query_policies"}],"panels":[]}]},"httpPath":"/v1/identity/policies"},{"label":"Query Users","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/identity/identity_query_users","routeSlug":"/api-reference/connectors/identity/identity_query_users","metadata":{"seo":{"title":"Query Users","description":"Returns a list of User objects wrapped in the OCSF Entity Management event of type Read from the token-linked identity provider."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"identity_query_users","name":"Query Users","isWebhook":false,"pointer":"/paths/~1v1~1identity~1users/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Users","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects wrapped in the OCSF Entity Management event of type Read from the token-linked identity provider."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"identity_query_users"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of users to return. Defaults to 100."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"email_addr[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"email_addr"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/identity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1identity~1users/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/identity/users","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/identity/users","href":"identity/identity_query_users","openApiOperationId":"identity_query_users","summary":"Query Users"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryUsersResponse"}},"schemaId":"components/schemas/QueryUsersResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1identity~1users/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryUsersResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryUsersResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/identity/identity_query_users"}],"panels":[]}]},"httpPath":"/v1/identity/users"},{"label":"Get User","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/identity/identity_get_user","routeSlug":"/api-reference/connectors/identity/identity_get_user","metadata":{"seo":{"title":"Get User","description":"Returns a User object wrapped in an OCSF Entity Management event of type Read from the token-linked identity provider. Dependingon the providers offerings, this may include additional user information, such as the user's current groups, roles, and Identity Protection risk state (when the provider exposes it and the user has a risk record)."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"identity_get_user","name":"Get User","isWebhook":false,"pointer":"/paths/~1v1~1identity~1users~1{userId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get User","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object wrapped in an OCSF Entity Management event of type Read from the token-linked identity provider. Depending"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"on the providers offerings, this may include additional user information, such as the user's current groups, roles, and Identity Protection risk state (when the provider exposes it and the user has a risk record)."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"identity_get_user"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"userId","in":"path","schemaId":"schema_23","required":true}],"pointer":"/paths/~1v1~1identity~1users~1{userId}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1identity~1users~1{userId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/identity/users/{userId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"userId","in":"path","required":true,"schemaId":"components/schemas/UserId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/identity/users/{userId}","href":"identity/identity_get_user","openApiOperationId":"identity_get_user","summary":"Get User"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetUserResponse"}},"schemaId":"components/schemas/GetUserResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1identity~1users~1{userId}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetUserResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetUserResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/identity/identity_get_user"}],"panels":[]}]},"httpPath":"/v1/identity/users/{userId}"},{"label":"Query Groups","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/identity/identity_query_groups","routeSlug":"/api-reference/connectors/identity/identity_query_groups","metadata":{"seo":{"title":"Query Groups","description":"Returns a list of Group objects wrapped in the OCSF Entity Management event of type Read from the token-linked identity provider."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"identity_query_groups","name":"Query Groups","isWebhook":false,"pointer":"/paths/~1v1~1identity~1groups/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Groups","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Group"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects wrapped in the OCSF Entity Management event of type Read from the token-linked identity provider."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"identity_query_groups"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of users to return. Defaults to 100."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"email_addr[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"email_addr"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in ascending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/identity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1identity~1groups/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/identity/groups","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/identity/groups","href":"identity/identity_query_groups","openApiOperationId":"identity_query_groups","summary":"Query Groups"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryGroupsResponse"}},"schemaId":"components/schemas/QueryGroupsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1identity~1groups/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryGroupsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryGroupsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/identity/identity_query_groups"}],"panels":[]}]},"httpPath":"/v1/identity/groups"},{"label":"Get Group","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/identity/identity_get_group","routeSlug":"/api-reference/connectors/identity/identity_get_group","metadata":{"seo":{"title":"Get Group","description":"Returns a Group object wrapped in an OCSF Entity Management event of type Read from the token-linked identity provider. Dependingon the providers offerings, this may include additional group information, such as the roles assigned."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"identity_get_group","name":"Get Group","isWebhook":false,"pointer":"/paths/~1v1~1identity~1groups~1{groupId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Group","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Group"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object wrapped in an OCSF Entity Management event of type Read from the token-linked identity provider. Depending"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"on the providers offerings, this may include additional group information, such as the roles assigned."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"identity_get_group"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"groupId","in":"path","schemaId":"schema_24","required":true}],"pointer":"/paths/~1v1~1identity~1groups~1{groupId}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1identity~1groups~1{groupId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/identity/groups/{groupId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"groupId","in":"path","required":true,"schemaId":"components/schemas/GroupId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/identity/groups/{groupId}","href":"identity/identity_get_group","openApiOperationId":"identity_get_group","summary":"Get Group"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetGroupResponse"}},"schemaId":"components/schemas/GetGroupResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1identity~1groups~1{groupId}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetGroupResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetGroupResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/identity/identity_get_group"}],"panels":[]}]},"httpPath":"/v1/identity/groups/{groupId}"},{"label":"Get Group Members","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/identity/identity_get_group_members","routeSlug":"/api-reference/connectors/identity/identity_get_group_members","metadata":{"seo":{"title":"Get Group Members","description":"Returns list of User objects wrapped in an OCSF Entity Management event of type Read from the token-linked identity provider that are members in the group referenced by ID."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"identity_get_group_members","name":"Get Group Members","isWebhook":false,"pointer":"/paths/~1v1~1identity~1groups~1{groupId}~1members/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Group Members","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects wrapped in an OCSF Entity Management event of type Read from the token-linked identity provider that are members in the group referenced by ID."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"identity_get_group_members"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"groupId","in":"path","schemaId":"schema_24","required":true}],"pointer":"/paths/~1v1~1identity~1groups~1{groupId}~1members/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of users to return. Defaults to 100."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."}],"pointer":"/paths/~1v1~1identity~1groups~1{groupId}~1members/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/identity/groups/{groupId}/members","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"groupId","in":"path","required":true,"schemaId":"components/schemas/GroupId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/identity/groups/{groupId}/members","href":"identity/identity_get_group_members","openApiOperationId":"identity_get_group_members","summary":"Get Group Members"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetGroupMembersResponse"}},"schemaId":"components/schemas/GetGroupMembersResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1identity~1groups~1{groupId}~1members/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetGroupMembersResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetGroupMembersResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/identity/identity_get_group_members"}],"panels":[]}]},"httpPath":"/v1/identity/groups/{groupId}/members"},{"label":"Enable User","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/identity/identity_enable_user","routeSlug":"/api-reference/connectors/identity/identity_enable_user","metadata":{"seo":{"title":"Enable User","description":"Reenables a disabled user in the identity system based on user ID."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"identity_enable_user","name":"Enable User","isWebhook":false,"pointer":"/paths/~1v1~1identity~1users~1{userId}~1actions~1enable/post","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Enable User","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Reenables a disabled user in the identity system based on user ID."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"identity_enable_user"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"userId","in":"path","schemaId":"schema_23","required":true}],"pointer":"/paths/~1v1~1identity~1users~1{userId}~1actions~1enable/post/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1identity~1users~1{userId}~1actions~1enable/post/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/identity/users/{userId}/actions/enable","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"userId","in":"path","required":true,"schemaId":"components/schemas/UserId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["204","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/identity/users/{userId}/actions/enable","href":"identity/identity_enable_user","openApiOperationId":"identity_enable_user","summary":"Enable User"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1identity~1users~1{userId}~1actions~1enable/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"204"},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/identity/identity_enable_user"}],"panels":[]}]},"httpPath":"/v1/identity/users/{userId}/actions/enable"},{"label":"Disable User","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/identity/identity_disable_user","routeSlug":"/api-reference/connectors/identity/identity_disable_user","metadata":{"seo":{"title":"Disable User","description":"Disables a user in the identity system based on user ID."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"identity_disable_user","name":"Disable User","isWebhook":false,"pointer":"/paths/~1v1~1identity~1users~1{userId}~1actions~1disable/post","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Disable User","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Disables a user in the identity system based on user ID."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"identity_disable_user"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"userId","in":"path","schemaId":"schema_23","required":true}],"pointer":"/paths/~1v1~1identity~1users~1{userId}~1actions~1disable/post/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1identity~1users~1{userId}~1actions~1disable/post/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/identity/users/{userId}/actions/disable","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"userId","in":"path","required":true,"schemaId":"components/schemas/UserId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["204","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/identity/users/{userId}/actions/disable","href":"identity/identity_disable_user","openApiOperationId":"identity_disable_user","summary":"Disable User"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1identity~1users~1{userId}~1actions~1disable/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"204"},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/identity/identity_disable_user"}],"panels":[]}]},"httpPath":"/v1/identity/users/{userId}/actions/disable"},{"label":"Force User Password Reset","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/identity/identity_force_user_password_reset","routeSlug":"/api-reference/connectors/identity/identity_force_user_password_reset","metadata":{"seo":{"title":"Force User Password Reset","description":"Forces a user to reset their password before they can log in again."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"identity_force_user_password_reset","name":"Force User Password Reset","isWebhook":false,"pointer":"/paths/~1v1~1identity~1users~1{userId}~1actions~1force_reset_password/post","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Force User Password Reset","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Forces a user to reset their password before they can log in again."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"identity_force_user_password_reset"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"userId","in":"path","schemaId":"schema_23","required":true}],"pointer":"/paths/~1v1~1identity~1users~1{userId}~1actions~1force_reset_password/post/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1identity~1users~1{userId}~1actions~1force_reset_password/post/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/identity/users/{userId}/actions/force_reset_password","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"userId","in":"path","required":true,"schemaId":"components/schemas/UserId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["204","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/identity/users/{userId}/actions/force_reset_password","href":"identity/identity_force_user_password_reset","openApiOperationId":"identity_force_user_password_reset","summary":"Force User Password Reset"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1identity~1users~1{userId}~1actions~1force_reset_password/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"204"},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/identity/identity_force_user_password_reset"}],"panels":[]}]},"httpPath":"/v1/identity/users/{userId}/actions/force_reset_password"},{"label":"Expire All User Sessions","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/identity/identity_expire_all_user_sessions","routeSlug":"/api-reference/connectors/identity/identity_expire_all_user_sessions","metadata":{"seo":{"title":"Expire All User Sessions","description":"Logs a user out of all current sessions so they must log in again."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"identity_expire_all_user_sessions","name":"Expire All User Sessions","isWebhook":false,"pointer":"/paths/~1v1~1identity~1users~1{userId}~1actions~1expire_all_sessions/post","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Expire All User Sessions","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Logs a user out of all current sessions so they must log in again."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"identity_expire_all_user_sessions"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"userId","in":"path","schemaId":"schema_23","required":true}],"pointer":"/paths/~1v1~1identity~1users~1{userId}~1actions~1expire_all_sessions/post/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1identity~1users~1{userId}~1actions~1expire_all_sessions/post/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/identity/users/{userId}/actions/expire_all_sessions","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"userId","in":"path","required":true,"schemaId":"components/schemas/UserId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["204","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/identity/users/{userId}/actions/expire_all_sessions","href":"identity/identity_expire_all_user_sessions","openApiOperationId":"identity_expire_all_user_sessions","summary":"Expire All User Sessions"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1identity~1users~1{userId}~1actions~1expire_all_sessions/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"204"},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/identity/identity_expire_all_user_sessions"}],"panels":[]}]},"httpPath":"/v1/identity/users/{userId}/actions/expire_all_sessions"},{"label":"Get User Picture","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/identity/identity_get_user_picture","routeSlug":"/api-reference/connectors/identity/identity_get_user_picture","metadata":{"seo":{"title":"Get User Picture","description":"This operation is available for testing but may be unstable. Breakingchanges are unlikely but may still be necessary.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"identity_get_user_picture","name":"Get User Picture","isWebhook":false,"pointer":"/paths/~1v1~1identity~1users~1{userId}~1picture/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get User Picture","badges":[{"name":"Beta","color":"pre-release","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"info","name":"Pre-Release"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is available for testing but may be unstable. Breaking"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"changes are unlikely but may still be necessary."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the profile picture for a user as binary image data. The Content-Type header indicates the image format (e.g., image/jpeg, image/png)."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"identity_get_user_picture"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"userId","in":"path","schemaId":"schema_23","required":true}],"pointer":"/paths/~1v1~1identity~1users~1{userId}~1picture/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/identity/users/{userId}/picture","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"userId","in":"path","required":true,"schemaId":"components/schemas/UserId"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["204","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/identity/users/{userId}/picture","href":"identity/identity_get_user_picture","openApiOperationId":"identity_get_user_picture","summary":"Get User Picture"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1identity~1users~1{userId}~1picture/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"204"},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/identity/identity_get_user_picture"}],"panels":[]}]},"badges":[{"name":"Beta","color":"pre-release","position":"before"}],"httpPath":"/v1/identity/users/{userId}/picture"}],"content":{"contentType":"group","meta":{"name":"Identity"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Identity","showPageActions":true}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/identity/audit","summary":"Query Audit Log","prefix":{"name":"get","color":"get"},"badges":[],"link":"/identity/identity_query_audit_log","deprecated":false},{"title":"/v1/identity/risk-events","summary":"Query Risk Events","prefix":{"name":"get","color":"get"},"badges":[],"link":"/identity/identity_query_risk_events","deprecated":false},{"title":"/v1/identity/risky-users","summary":"Query Risky Users","prefix":{"name":"get","color":"get"},"badges":[],"link":"/identity/identity_query_risky_users","deprecated":false},{"title":"/v1/identity/applications","summary":"Query Applications","prefix":{"name":"get","color":"get"},"badges":[],"link":"/identity/identity_query_applications","deprecated":false},{"title":"/v1/identity/access-grants","summary":"Query Access Grants","prefix":{"name":"get","color":"get"},"badges":[],"link":"/identity/identity_query_access_grants","deprecated":false},{"title":"/v1/identity/policies","summary":"Query Policies","prefix":{"name":"get","color":"get"},"badges":[],"link":"/identity/identity_query_policies","deprecated":false},{"title":"/v1/identity/users","summary":"Query Users","prefix":{"name":"get","color":"get"},"badges":[],"link":"/identity/identity_query_users","deprecated":false},{"title":"/v1/identity/users/{userId}","summary":"Get User","prefix":{"name":"get","color":"get"},"badges":[],"link":"/identity/identity_get_user","deprecated":false},{"title":"/v1/identity/groups","summary":"Query Groups","prefix":{"name":"get","color":"get"},"badges":[],"link":"/identity/identity_query_groups","deprecated":false},{"title":"/v1/identity/groups/{groupId}","summary":"Get Group","prefix":{"name":"get","color":"get"},"badges":[],"link":"/identity/identity_get_group","deprecated":false},{"title":"/v1/identity/groups/{groupId}/members","summary":"Get Group Members","prefix":{"name":"get","color":"get"},"badges":[],"link":"/identity/identity_get_group_members","deprecated":false},{"title":"/v1/identity/users/{userId}/actions/enable","summary":"Enable User","prefix":{"name":"post","color":"post"},"badges":[],"link":"/identity/identity_enable_user","deprecated":false},{"title":"/v1/identity/users/{userId}/actions/disable","summary":"Disable User","prefix":{"name":"post","color":"post"},"badges":[],"link":"/identity/identity_disable_user","deprecated":false},{"title":"/v1/identity/users/{userId}/actions/force_reset_password","summary":"Force User Password Reset","prefix":{"name":"post","color":"post"},"badges":[],"link":"/identity/identity_force_user_password_reset","deprecated":false},{"title":"/v1/identity/users/{userId}/actions/expire_all_sessions","summary":"Expire All User Sessions","prefix":{"name":"post","color":"post"},"badges":[],"link":"/identity/identity_expire_all_user_sessions","deprecated":false},{"title":"/v1/identity/users/{userId}/picture","summary":"Get User Picture","prefix":{"name":"get","color":"get"},"badges":[{"name":"Beta","color":"pre-release","position":"before"}],"link":"/identity/identity_get_user_picture","deprecated":false}]}]}]}]}},{"type":"group","label":"Incident Response (In Development)","link":"/api-reference/connectors/incidentresponse","routeSlug":"/api-reference/connectors/incidentresponse","items":[{"label":"Query Escalation Policies","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/incidentresponse/incidentresponse_query_escalation_policies","routeSlug":"/api-reference/connectors/incidentresponse/incidentresponse_query_escalation_policies","metadata":{"seo":{"title":"Query Escalation Policies","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"incidentresponse_query_escalation_policies","name":"Query Escalation Policies","isWebhook":false,"pointer":"/paths/~1v1~1incident-response~1escalation-policies/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Escalation Policies","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of incident response escalation policies."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"incidentresponse_query_escalation_policies"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of escalation policies to return. Defaults to 100."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."}],"pointer":"/paths/~1v1~1incident-response~1escalation-policies/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/incident-response/escalation-policies","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/incident-response/escalation-policies","href":"incidentresponse/incidentresponse_query_escalation_policies","openApiOperationId":"incidentresponse_query_escalation_policies","summary":"Query Escalation Policies"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/IncidentResponseQueryEscalationPoliciesResponse"}},"schemaId":"components/schemas/IncidentResponseQueryEscalationPoliciesResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1incident-response~1escalation-policies/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/IncidentResponseQueryEscalationPoliciesResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/IncidentResponseQueryEscalationPoliciesResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/incidentresponse/incidentresponse_query_escalation_policies"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/incident-response/escalation-policies"},{"label":"Query Escalation Policy Users On Call","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/incidentresponse/incidentresponse_query_escalation_policy_users_on_call","routeSlug":"/api-reference/connectors/incidentresponse/incidentresponse_query_escalation_policy_users_on_call","metadata":{"seo":{"title":"Query Escalation Policy Users On Call","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"incidentresponse_query_escalation_policy_users_on_call","name":"Query Escalation Policy Users On Call","isWebhook":false,"pointer":"/paths/~1v1~1incident-response~1escalation-policies~1{escalationPolicyId}~1users-on-call/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Escalation Policy Users On Call","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of users that are currently on call for an incident response escalation policy."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"incidentresponse_query_escalation_policy_users_on_call"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"escalationPolicyId","in":"path","schemaId":"schema_13","required":true}],"pointer":"/paths/~1v1~1incident-response~1escalation-policies~1{escalationPolicyId}~1users-on-call/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1incident-response~1escalation-policies~1{escalationPolicyId}~1users-on-call/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/incident-response/escalation-policies/{escalationPolicyId}/users-on-call","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"escalationPolicyId","in":"path","required":true,"schemaId":"components/schemas/ApplicationId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/incident-response/escalation-policies/{escalationPolicyId}/users-on-call","href":"incidentresponse/incidentresponse_query_escalation_policy_users_on_call","openApiOperationId":"incidentresponse_query_escalation_policy_users_on_call","summary":"Query Escalation Policy Users On Call"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/IncidentResponseQueryEscalationPolicyUsersOnCallResponse"}},"schemaId":"components/schemas/IncidentResponseQueryEscalationPolicyUsersOnCallResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1incident-response~1escalation-policies~1{escalationPolicyId}~1users-on-call/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/IncidentResponseQueryEscalationPolicyUsersOnCallResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/IncidentResponseQueryEscalationPolicyUsersOnCallResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/incidentresponse/incidentresponse_query_escalation_policy_users_on_call"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/incident-response/escalation-policies/{escalationPolicyId}/users-on-call"}],"content":{"contentType":"group","meta":{"name":"Incidentresponse"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Incident Response (In Development)","showPageActions":true},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This feature is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this feature."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"}]}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/incident-response/escalation-policies","summary":"Query Escalation Policies","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/incidentresponse/incidentresponse_query_escalation_policies","deprecated":false},{"title":"/v1/incident-response/escalation-policies/{escalationPolicyId}/users-on-call","summary":"Query Escalation Policy Users On Call","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/incidentresponse/incidentresponse_query_escalation_policy_users_on_call","deprecated":false}]}]}]}]}},{"type":"group","label":"Integration Webhooks","link":"/api-reference/connectors/integrationwebhooks","routeSlug":"/api-reference/connectors/integrationwebhooks","items":[{"label":"Create Integration WebHook Configuration","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/integrationwebhooks/integrationwebhooks_create_webhook","routeSlug":"/api-reference/connectors/integrationwebhooks/integrationwebhooks_create_webhook","metadata":{"seo":{"title":"Create Integration WebHook Configuration","description":"Creates a WebHook for the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"integrationWebhooks_create_webhook","name":"Create Integration WebHook Configuration","isWebhook":false,"pointer":"/paths/~1v1~1integration-webhooks/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Create Integration WebHook Configuration","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Creates a WebHook for the token-linked Integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"integrationWebhooks_create_webhook"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateIntegrationWebHookRequest"}},"schemaId":"components/schemas/CreateIntegrationWebHookRequest","pointer":"/paths/~1v1~1integration-webhooks/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/integration-webhooks","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/CreateIntegrationWebHookRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/integration-webhooks","href":"integrationwebhooks/integrationwebhooks_create_webhook","openApiOperationId":"integrationWebhooks_create_webhook","summary":"Create Integration WebHook Configuration"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/CreateIntegrationWebHookRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateIntegrationWebHookRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateIntegrationWebHookResponse"}},"schemaId":"components/schemas/CreateIntegrationWebHookResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1integration-webhooks/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/CreateIntegrationWebHookResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateIntegrationWebHookResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/integrationwebhooks/integrationwebhooks_create_webhook"}],"panels":[]}]},"httpPath":"/v1/integration-webhooks"},{"label":"Delete Integration WebHook Configuration","deprecated":false,"httpVerb":"delete","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/integrationwebhooks/integrationwebhooks_delete_webhook","routeSlug":"/api-reference/connectors/integrationwebhooks/integrationwebhooks_delete_webhook","metadata":{"seo":{"title":"Delete Integration WebHook Configuration","description":"Deletes the WebHook matching the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"integrationWebhooks_delete_webhook","name":"Delete Integration WebHook Configuration","isWebhook":false,"pointer":"/paths/~1v1~1integration-webhooks/delete","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Delete Integration WebHook Configuration","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Deletes the WebHook matching the token-linked Integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"integrationWebhooks_delete_webhook"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"DELETE","path":"/v1/integration-webhooks","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["204","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/integration-webhooks","href":"integrationwebhooks/integrationwebhooks_delete_webhook","openApiOperationId":"integrationWebhooks_delete_webhook","summary":"Delete Integration WebHook Configuration"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1integration-webhooks/delete/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"204"},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/integrationwebhooks/integrationwebhooks_delete_webhook"}],"panels":[]}]},"httpPath":"/v1/integration-webhooks"},{"label":"List Integration WebHook Configurations","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/integrationwebhooks/integrationwebhooks_list_webhooks","routeSlug":"/api-reference/connectors/integrationwebhooks/integrationwebhooks_list_webhooks","metadata":{"seo":{"title":"List Integration WebHook Configurations","description":"Lists all WebHooks from the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"integrationWebhooks_list_webhooks","name":"List Integration WebHook Configurations","isWebhook":false,"pointer":"/paths/~1v1~1integration-webhooks/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"List Integration WebHook Configurations","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Lists all WebHooks from the token-linked Integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"integrationWebhooks_list_webhooks"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/integration-webhooks","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/integration-webhooks","href":"integrationwebhooks/integrationwebhooks_list_webhooks","openApiOperationId":"integrationWebhooks_list_webhooks","summary":"List Integration WebHook Configurations"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListIntegrationWebHooksResponse"}},"schemaId":"components/schemas/ListIntegrationWebHooksResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1integration-webhooks/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ListIntegrationWebHooksResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListIntegrationWebHooksResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/integrationwebhooks/integrationwebhooks_list_webhooks"}],"panels":[]}]},"httpPath":"/v1/integration-webhooks"}],"content":{"contentType":"group","meta":{"name":"IntegrationWebhooks"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Integration Webhooks","showPageActions":true}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/integration-webhooks","summary":"Create Integration WebHook Configuration","prefix":{"name":"post","color":"post"},"badges":[],"link":"/integrationwebhooks/integrationwebhooks_create_webhook","deprecated":false},{"title":"/v1/integration-webhooks","summary":"Delete Integration WebHook Configuration","prefix":{"name":"delete","color":"delete"},"badges":[],"link":"/integrationwebhooks/integrationwebhooks_delete_webhook","deprecated":false},{"title":"/v1/integration-webhooks","summary":"List Integration WebHook Configurations","prefix":{"name":"get","color":"get"},"badges":[],"link":"/integrationwebhooks/integrationwebhooks_list_webhooks","deprecated":false}]}]}]}]}},{"type":"group","label":"Network Security (In Development)","link":"/api-reference/connectors/networksecurity","routeSlug":"/api-reference/connectors/networksecurity","items":[{"label":"Query Traffic Log Configurations","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/networksecurity/networksecurity_query_traffic_log_configurations","routeSlug":"/api-reference/connectors/networksecurity/networksecurity_query_traffic_log_configurations","metadata":{"seo":{"title":"Query Traffic Log Configurations","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"networksecurity_query_traffic_log_configurations","name":"Query Traffic Log Configurations","isWebhook":false,"pointer":"/paths/~1v1~1network-security~1traffic~1log-configurations/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Traffic Log Configurations","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns traffic log configurations discovered for the integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"networksecurity_query_traffic_log_configurations"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of traffic log configurations to return. Defaults to 100 with a maximum of 200. If a provider has a maximum limit lower than 200, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/networksecurity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together. No network security provider currently supports filters on this endpoint, so a request that includes a filter is rejected with a 400 error."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."}],"pointer":"/paths/~1v1~1network-security~1traffic~1log-configurations/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/network-security/traffic/log-configurations","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/network-security/traffic/log-configurations","href":"networksecurity/networksecurity_query_traffic_log_configurations","openApiOperationId":"networksecurity_query_traffic_log_configurations","summary":"Query Traffic Log Configurations"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryTrafficLogConfigurationsResponse"}},"schemaId":"components/schemas/QueryTrafficLogConfigurationsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1network-security~1traffic~1log-configurations/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryTrafficLogConfigurationsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryTrafficLogConfigurationsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/networksecurity/networksecurity_query_traffic_log_configurations"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/network-security/traffic/log-configurations"},{"label":"Query Traffic Events","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/networksecurity/networksecurity_query_traffic_events","routeSlug":"/api-reference/connectors/networksecurity/networksecurity_query_traffic_events","metadata":{"seo":{"title":"Query Traffic Events","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"networksecurity_query_traffic_events","name":"Query Traffic Events","isWebhook":false,"pointer":"/paths/~1v1~1network-security~1traffic~1log-events/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Traffic Events","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns traffic events from traffic log configurations on the"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"integration. Results are normalized to OCSF Network Activity (class_uid 4001)."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"networksecurity_query_traffic_events"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of traffic events to return. Defaults to 100 with a maximum of 200. If a provider has a maximum limit lower than 200, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/networksecurity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together. Network security providers support only the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time[gte]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time[lte]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" filters on this endpoint, and any other filter is rejected with a 400 error. When no time filter is supplied, the query covers the most recent hour."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."}],"pointer":"/paths/~1v1~1network-security~1traffic~1log-events/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/network-security/traffic/log-events","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/network-security/traffic/log-events","href":"networksecurity/networksecurity_query_traffic_events","openApiOperationId":"networksecurity_query_traffic_events","summary":"Query Traffic Events"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryTrafficEventsResponse"}},"schemaId":"components/schemas/QueryTrafficEventsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1network-security~1traffic~1log-events/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryTrafficEventsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryTrafficEventsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/networksecurity/networksecurity_query_traffic_events"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/network-security/traffic/log-events"},{"label":"Query DNS Log Configurations","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/networksecurity/networksecurity_query_dns_log_configurations","routeSlug":"/api-reference/connectors/networksecurity/networksecurity_query_dns_log_configurations","metadata":{"seo":{"title":"Query DNS Log Configurations","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"networksecurity_query_dns_log_configurations","name":"Query DNS Log Configurations","isWebhook":false,"pointer":"/paths/~1v1~1network-security~1dns~1log-configurations/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query DNS Log Configurations","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns DNS log configurations discovered for the integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"networksecurity_query_dns_log_configurations"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of DNS log configurations to return. Defaults to 100 with a maximum of 200. If a provider has a maximum limit lower than 200, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/networksecurity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together. No network security provider currently supports filters on this endpoint, so a request that includes a filter is rejected with a 400 error."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."}],"pointer":"/paths/~1v1~1network-security~1dns~1log-configurations/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/network-security/dns/log-configurations","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/network-security/dns/log-configurations","href":"networksecurity/networksecurity_query_dns_log_configurations","openApiOperationId":"networksecurity_query_dns_log_configurations","summary":"Query DNS Log Configurations"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryDNSLogConfigurationsResponse"}},"schemaId":"components/schemas/QueryDNSLogConfigurationsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1network-security~1dns~1log-configurations/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryDNSLogConfigurationsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryDNSLogConfigurationsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/networksecurity/networksecurity_query_dns_log_configurations"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/network-security/dns/log-configurations"},{"label":"Query DNS Events","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/networksecurity/networksecurity_query_dns_events","routeSlug":"/api-reference/connectors/networksecurity/networksecurity_query_dns_events","metadata":{"seo":{"title":"Query DNS Events","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"networksecurity_query_dns_events","name":"Query DNS Events","isWebhook":false,"pointer":"/paths/~1v1~1network-security~1dns~1log-events/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query DNS Events","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns DNS events from DNS log configurations on the"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"integration. Results are normalized to OCSF DNS Activity (class_uid 4003)."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"networksecurity_query_dns_events"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of DNS events to return. Defaults to 100 with a maximum of 200. If a provider has a maximum limit lower than 200, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/networksecurity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together. Network security providers support only the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time[gte]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time[lte]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" filters on this endpoint, and any other filter is rejected with a 400 error. When no time filter is supplied, the query covers the most recent hour."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."}],"pointer":"/paths/~1v1~1network-security~1dns~1log-events/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/network-security/dns/log-events","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/network-security/dns/log-events","href":"networksecurity/networksecurity_query_dns_events","openApiOperationId":"networksecurity_query_dns_events","summary":"Query DNS Events"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryDNSEventsResponse"}},"schemaId":"components/schemas/QueryDNSEventsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1network-security~1dns~1log-events/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryDNSEventsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryDNSEventsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/networksecurity/networksecurity_query_dns_events"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/network-security/dns/log-events"},{"label":"Query Firewall Rules","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/networksecurity/networksecurity_query_firewall_rules","routeSlug":"/api-reference/connectors/networksecurity/networksecurity_query_firewall_rules","metadata":{"seo":{"title":"Query Firewall Rules","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"networksecurity_query_firewall_rules","name":"Query Firewall Rules","isWebhook":false,"pointer":"/paths/~1v1~1network-security~1firewall-rules/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Firewall Rules","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the firewall rules that control traffic within the integration's scope. Built-in default rules that the provider's API does not"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"report are not included. A rule that applies to several networks is returned once per network"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"networksecurity_query_firewall_rules"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of firewall rules to return. Defaults to 100 with a maximum of 200. If a provider has a maximum limit lower than 200, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/networksecurity/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together. No network security provider currently supports filters on this endpoint, so a request that includes a filter is rejected with a 400 error."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."}],"pointer":"/paths/~1v1~1network-security~1firewall-rules/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/network-security/firewall-rules","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/network-security/firewall-rules","href":"networksecurity/networksecurity_query_firewall_rules","openApiOperationId":"networksecurity_query_firewall_rules","summary":"Query Firewall Rules"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryFirewallRulesResponse"}},"schemaId":"components/schemas/QueryFirewallRulesResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1network-security~1firewall-rules/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryFirewallRulesResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryFirewallRulesResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/networksecurity/networksecurity_query_firewall_rules"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/network-security/firewall-rules"}],"content":{"contentType":"group","meta":{"name":"Networksecurity"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Network Security (In Development)","showPageActions":true},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This feature is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this feature."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"}]}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/network-security/traffic/log-configurations","summary":"Query Traffic Log Configurations","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/networksecurity/networksecurity_query_traffic_log_configurations","deprecated":false},{"title":"/v1/network-security/traffic/log-events","summary":"Query Traffic Events","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/networksecurity/networksecurity_query_traffic_events","deprecated":false},{"title":"/v1/network-security/dns/log-configurations","summary":"Query DNS Log Configurations","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/networksecurity/networksecurity_query_dns_log_configurations","deprecated":false},{"title":"/v1/network-security/dns/log-events","summary":"Query DNS Events","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/networksecurity/networksecurity_query_dns_events","deprecated":false},{"title":"/v1/network-security/firewall-rules","summary":"Query Firewall Rules","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/networksecurity/networksecurity_query_firewall_rules","deprecated":false}]}]}]}]}},{"type":"group","label":"Notifications","link":"/api-reference/connectors/notifications","routeSlug":"/api-reference/connectors/notifications","items":[{"label":"Get Notification","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/notifications/notifications_get_message","routeSlug":"/api-reference/connectors/notifications/notifications_get_message","metadata":{"seo":{"title":"Get Notification","description":"Returns the Notification object matching {notificationId} from the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"notifications_get_message","name":"Get Notification","isWebhook":false,"pointer":"/paths/~1v1~1notifications~1get~1{notificationId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Notification","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notification"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{notificationId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from the token-linked "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Integration"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"notifications_get_message"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"notificationId","in":"path","schemaId":"schema_25","required":true}],"pointer":"/paths/~1v1~1notifications~1get~1{notificationId}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1notifications~1get~1{notificationId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/notifications/get/{notificationId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"notificationId","in":"path","required":true,"schemaId":"schema_26"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/notifications/get/{notificationId}","href":"notifications/notifications_get_message","openApiOperationId":"notifications_get_message","summary":"Get Notification"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetNotificationResponse"}},"schemaId":"components/schemas/GetNotificationResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1notifications~1get~1{notificationId}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetNotificationResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetNotificationResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/notifications/notifications_get_message"}],"panels":[]}]},"httpPath":"/v1/notifications/get/{notificationId}"},{"label":"Create Notification","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/notifications/notifications_create_message","routeSlug":"/api-reference/connectors/notifications/notifications_create_message","metadata":{"seo":{"title":"Create Notification","description":"Creates a Notification object in the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"notifications_create_message","name":"Create Notification","isWebhook":false,"pointer":"/paths/~1v1~1notifications~1create/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Create Notification","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Creates a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notification"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object in the token-linked "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Integration"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"notifications_create_message"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1notifications~1create/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateNotificationRequest"}},"schemaId":"components/schemas/CreateNotificationRequest","pointer":"/paths/~1v1~1notifications~1create/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/notifications/create","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/CreateNotificationRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/notifications/create","href":"notifications/notifications_create_message","openApiOperationId":"notifications_create_message","summary":"Create Notification"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/CreateNotificationRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateNotificationRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateNotificationResponse"}},"schemaId":"components/schemas/CreateNotificationResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1notifications~1create/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/CreateNotificationResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateNotificationResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/notifications/notifications_create_message"}],"panels":[]}]},"httpPath":"/v1/notifications/create"},{"label":"Clear Notification","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/notifications/notifications_clear_message","routeSlug":"/api-reference/connectors/notifications/notifications_clear_message","metadata":{"seo":{"title":"Clear Notification","description":"Resolves a Notification object in the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"notifications_clear_message","name":"Clear Notification","isWebhook":false,"pointer":"/paths/~1v1~1notifications~1clear~1{notificationId}/post","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Clear Notification","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Resolves a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notification"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object in the token-linked "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Integration"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"notifications_clear_message"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"notificationId","in":"path","schemaId":"schema_25","required":true}],"pointer":"/paths/~1v1~1notifications~1clear~1{notificationId}/post/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1notifications~1clear~1{notificationId}/post/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/notifications/clear/{notificationId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"notificationId","in":"path","required":true,"schemaId":"schema_26"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["204","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/notifications/clear/{notificationId}","href":"notifications/notifications_clear_message","openApiOperationId":"notifications_clear_message","summary":"Clear Notification"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1notifications~1clear~1{notificationId}/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"204"},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/notifications/notifications_clear_message"}],"panels":[]}]},"httpPath":"/v1/notifications/clear/{notificationId}"}],"content":{"contentType":"group","meta":{"name":"Notifications"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Notifications","showPageActions":true}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/notifications/get/{notificationId}","summary":"Get Notification","prefix":{"name":"get","color":"get"},"badges":[],"link":"/notifications/notifications_get_message","deprecated":false},{"title":"/v1/notifications/create","summary":"Create Notification","prefix":{"name":"post","color":"post"},"badges":[],"link":"/notifications/notifications_create_message","deprecated":false},{"title":"/v1/notifications/clear/{notificationId}","summary":"Clear Notification","prefix":{"name":"post","color":"post"},"badges":[],"link":"/notifications/notifications_clear_message","deprecated":false}]}]}]}]}},{"type":"group","label":"Operations (In Development)","link":"/api-reference/connectors/operations","routeSlug":"/api-reference/connectors/operations","items":[{"label":"Get Asynchronous Operation state","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/operations/operations_get","routeSlug":"/api-reference/connectors/operations/operations_get","metadata":{"seo":{"title":"Get Asynchronous Operation state","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"operations_get","name":"Get Asynchronous Operation state","isWebhook":false,"pointer":"/paths/~1v1~1operations~1{operationId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Asynchronous Operation state","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Asynchronous Operation"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{operationId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"operations_get"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"operationId","in":"path","schemaId":"schema_27","required":true}],"pointer":"/paths/~1v1~1operations~1{operationId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/operations/{operationId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"operationId","in":"path","required":true,"schemaId":"schema_28"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500"],"pointer":"/v1/operations/{operationId}","href":"operations/operations_get","openApiOperationId":"operations_get","summary":"Get Asynchronous Operation state"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetOperationResponse"}},"schemaId":"components/schemas/GetOperationResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1operations~1{operationId}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetOperationResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetOperationResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/operations/operations_get"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/operations/{operationId}"},{"label":"Cancel Asynchronous Operation","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/operations/operations_cancel","routeSlug":"/api-reference/connectors/operations/operations_cancel","metadata":{"seo":{"title":"Cancel Asynchronous Operation","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"operations_cancel","name":"Cancel Asynchronous Operation","isWebhook":false,"pointer":"/paths/~1v1~1operations~1{operationId}/post","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Cancel Asynchronous Operation","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Cancels the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Asynchronous Operation"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{operationId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"operations_cancel"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"operationId","in":"path","schemaId":"schema_27","required":true}],"pointer":"/paths/~1v1~1operations~1{operationId}/post/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/operations/{operationId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"operationId","in":"path","required":true,"schemaId":"schema_28"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["204","400","401","402","403","404","405","409","415","429","500"],"pointer":"/v1/operations/{operationId}","href":"operations/operations_cancel","openApiOperationId":"operations_cancel","summary":"Cancel Asynchronous Operation"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1operations~1{operationId}/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"204"},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/operations/operations_cancel"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/operations/{operationId}"},{"label":"Create Asynchronous Operation","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/operations/operations_create","routeSlug":"/api-reference/connectors/operations/operations_create","metadata":{"seo":{"title":"Create Asynchronous Operation","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"operations_create","name":"Create Asynchronous Operation","isWebhook":false,"pointer":"/paths/~1v1~1operations/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Create Asynchronous Operation","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Creates an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Asynchronous Operation"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"operations_create"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateOperationRequest"}},"schemaId":"components/schemas/CreateOperationRequest","pointer":"/paths/~1v1~1operations/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/operations","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/CreateOperationRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500"],"pointer":"/v1/operations","href":"operations/operations_create","openApiOperationId":"operations_create","summary":"Create Asynchronous Operation"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/CreateOperationRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateOperationRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateOperationResponse"}},"schemaId":"components/schemas/CreateOperationResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1operations/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/CreateOperationResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateOperationResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/operations/operations_create"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/operations"}],"content":{"contentType":"group","meta":{"name":"Operations"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Operations (In Development)","showPageActions":true},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This feature is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this feature."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"}]}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/operations/{operationId}","summary":"Get Asynchronous Operation state","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/operations/operations_get","deprecated":false},{"title":"/v1/operations/{operationId}","summary":"Cancel Asynchronous Operation","prefix":{"name":"post","color":"post"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/operations/operations_cancel","deprecated":false},{"title":"/v1/operations","summary":"Create Asynchronous Operation","prefix":{"name":"post","color":"post"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/operations/operations_create","deprecated":false}]}]}]}]}},{"type":"group","label":"Security Awareness (In Development)","link":"/api-reference/connectors/securityawareness","routeSlug":"/api-reference/connectors/securityawareness","items":[{"label":"Query Training Campaigns","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/securityawareness/securityawareness_query_training_campaigns","routeSlug":"/api-reference/connectors/securityawareness/securityawareness_query_training_campaigns","metadata":{"seo":{"title":"Query Training Campaigns","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"securityawareness_query_training_campaigns","name":"Query Training Campaigns","isWebhook":false,"pointer":"/paths/~1v1~1security-awareness~1training~1campaigns/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Training Campaigns","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of training campaigns matching the query from the token-linked security awareness integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"securityawareness_query_training_campaigns"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of training campaigns to return. Defaults to 100 with a maximum of 1000. If a provider has a maximum limit lower than 1000, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/security-awareness/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1security-awareness~1training~1campaigns/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/security-awareness/training/campaigns","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/security-awareness/training/campaigns","href":"securityawareness/securityawareness_query_training_campaigns","openApiOperationId":"securityawareness_query_training_campaigns","summary":"Query Training Campaigns"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/SecurityAwarenessQueryTrainingCampaignsResponse"}},"schemaId":"components/schemas/SecurityAwarenessQueryTrainingCampaignsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1security-awareness~1training~1campaigns/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/SecurityAwarenessQueryTrainingCampaignsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/SecurityAwarenessQueryTrainingCampaignsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/securityawareness/securityawareness_query_training_campaigns"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/security-awareness/training/campaigns"},{"label":"Query Phishing Simulations","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/securityawareness/securityawareness_query_phishing_simulations","routeSlug":"/api-reference/connectors/securityawareness/securityawareness_query_phishing_simulations","metadata":{"seo":{"title":"Query Phishing Simulations","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"securityawareness_query_phishing_simulations","name":"Query Phishing Simulations","isWebhook":false,"pointer":"/paths/~1v1~1security-awareness~1phishing~1simulations/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Phishing Simulations","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of phishing simulations matching the query from the token-linked security awareness integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"securityawareness_query_phishing_simulations"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of phishing simulations to return. Defaults to 100 with a maximum of 1000. If a provider has a maximum limit lower than 1000, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/security-awareness/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1security-awareness~1phishing~1simulations/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/security-awareness/phishing/simulations","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/security-awareness/phishing/simulations","href":"securityawareness/securityawareness_query_phishing_simulations","openApiOperationId":"securityawareness_query_phishing_simulations","summary":"Query Phishing Simulations"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/SecurityAwarenessQueryPhishingSimulationsResponse"}},"schemaId":"components/schemas/SecurityAwarenessQueryPhishingSimulationsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1security-awareness~1phishing~1simulations/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/SecurityAwarenessQueryPhishingSimulationsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/SecurityAwarenessQueryPhishingSimulationsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/securityawareness/securityawareness_query_phishing_simulations"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/security-awareness/phishing/simulations"},{"label":"Query Users","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/securityawareness/securityawareness_query_users","routeSlug":"/api-reference/connectors/securityawareness/securityawareness_query_users","metadata":{"seo":{"title":"Query Users","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"securityawareness_query_users","name":"Query Users","isWebhook":false,"pointer":"/paths/~1v1~1security-awareness~1users/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Users","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of users matching the query from the token-linked security awareness integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"securityawareness_query_users"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of users to return. Defaults to 100 with a maximum of 1000. If a provider has a maximum limit lower than 1000, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/security-awareness/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1security-awareness~1users/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/security-awareness/users","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/security-awareness/users","href":"securityawareness/securityawareness_query_users","openApiOperationId":"securityawareness_query_users","summary":"Query Users"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/SecurityAwarenessQueryUsersResponse"}},"schemaId":"components/schemas/SecurityAwarenessQueryUsersResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1security-awareness~1users/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/SecurityAwarenessQueryUsersResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/SecurityAwarenessQueryUsersResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/securityawareness/securityawareness_query_users"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/security-awareness/users"},{"label":"Get Training Campaign Details","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/securityawareness/securityawareness_get_training_campaign_details","routeSlug":"/api-reference/connectors/securityawareness/securityawareness_get_training_campaign_details","metadata":{"seo":{"title":"Get Training Campaign Details","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"securityawareness_get_training_campaign_details","name":"Get Training Campaign Details","isWebhook":false,"pointer":"/paths/~1v1~1security-awareness~1training~1campaigns~1{trainingCampaignId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Training Campaign Details","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the details of the training campaign matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{trainingCampaignId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from the token-linked security awareness integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"securityawareness_get_training_campaign_details"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"trainingCampaignId","in":"path","schemaId":"schema_13","required":true}],"pointer":"/paths/~1v1~1security-awareness~1training~1campaigns~1{trainingCampaignId}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1security-awareness~1training~1campaigns~1{trainingCampaignId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/security-awareness/training/campaigns/{trainingCampaignId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"trainingCampaignId","in":"path","required":true,"schemaId":"components/schemas/ApplicationId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/security-awareness/training/campaigns/{trainingCampaignId}","href":"securityawareness/securityawareness_get_training_campaign_details","openApiOperationId":"securityawareness_get_training_campaign_details","summary":"Get Training Campaign Details"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/SecurityAwarenessGetTrainingCampaignDetailsResponse"}},"schemaId":"components/schemas/SecurityAwarenessGetTrainingCampaignDetailsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1security-awareness~1training~1campaigns~1{trainingCampaignId}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/SecurityAwarenessGetTrainingCampaignDetailsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/SecurityAwarenessGetTrainingCampaignDetailsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/securityawareness/securityawareness_get_training_campaign_details"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/security-awareness/training/campaigns/{trainingCampaignId}"},{"label":"Get Phishing Simulation Details","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/securityawareness/securityawareness_get_phishing_simulation_details","routeSlug":"/api-reference/connectors/securityawareness/securityawareness_get_phishing_simulation_details","metadata":{"seo":{"title":"Get Phishing Simulation Details","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"securityawareness_get_phishing_simulation_details","name":"Get Phishing Simulation Details","isWebhook":false,"pointer":"/paths/~1v1~1security-awareness~1phishing~1simulations~1{phishingSimulationId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Phishing Simulation Details","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the details of the phishing simulation matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{phishingSimulationId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from the token-linked security awareness integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"securityawareness_get_phishing_simulation_details"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"phishingSimulationId","in":"path","schemaId":"schema_13","required":true}],"pointer":"/paths/~1v1~1security-awareness~1phishing~1simulations~1{phishingSimulationId}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1security-awareness~1phishing~1simulations~1{phishingSimulationId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/security-awareness/phishing/simulations/{phishingSimulationId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"phishingSimulationId","in":"path","required":true,"schemaId":"components/schemas/ApplicationId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/security-awareness/phishing/simulations/{phishingSimulationId}","href":"securityawareness/securityawareness_get_phishing_simulation_details","openApiOperationId":"securityawareness_get_phishing_simulation_details","summary":"Get Phishing Simulation Details"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/SecurityAwarenessGetPhishingSimulationDetailsResponse"}},"schemaId":"components/schemas/SecurityAwarenessGetPhishingSimulationDetailsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1security-awareness~1phishing~1simulations~1{phishingSimulationId}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/SecurityAwarenessGetPhishingSimulationDetailsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/SecurityAwarenessGetPhishingSimulationDetailsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/securityawareness/securityawareness_get_phishing_simulation_details"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/security-awareness/phishing/simulations/{phishingSimulationId}"},{"label":"Get User Details","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/securityawareness/securityawareness_get_user_details","routeSlug":"/api-reference/connectors/securityawareness/securityawareness_get_user_details","metadata":{"seo":{"title":"Get User Details","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"securityawareness_get_user_details","name":"Get User Details","isWebhook":false,"pointer":"/paths/~1v1~1security-awareness~1users~1{userId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get User Details","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the details of the user matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{userId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from the token-linked security awareness integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"securityawareness_get_user_details"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"userId","in":"path","schemaId":"schema_13","required":true}],"pointer":"/paths/~1v1~1security-awareness~1users~1{userId}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1security-awareness~1users~1{userId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/security-awareness/users/{userId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"userId","in":"path","required":true,"schemaId":"components/schemas/ApplicationId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/security-awareness/users/{userId}","href":"securityawareness/securityawareness_get_user_details","openApiOperationId":"securityawareness_get_user_details","summary":"Get User Details"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/SecurityAwarenessGetUserDetailsResponse"}},"schemaId":"components/schemas/SecurityAwarenessGetUserDetailsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1security-awareness~1users~1{userId}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/SecurityAwarenessGetUserDetailsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/SecurityAwarenessGetUserDetailsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/securityawareness/securityawareness_get_user_details"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/security-awareness/users/{userId}"}],"content":{"contentType":"group","meta":{"name":"Securityawareness"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Security Awareness (In Development)","showPageActions":true},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This feature is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this feature."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"}]}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/security-awareness/training/campaigns","summary":"Query Training Campaigns","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/securityawareness/securityawareness_query_training_campaigns","deprecated":false},{"title":"/v1/security-awareness/phishing/simulations","summary":"Query Phishing Simulations","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/securityawareness/securityawareness_query_phishing_simulations","deprecated":false},{"title":"/v1/security-awareness/users","summary":"Query Users","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/securityawareness/securityawareness_query_users","deprecated":false},{"title":"/v1/security-awareness/training/campaigns/{trainingCampaignId}","summary":"Get Training Campaign Details","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/securityawareness/securityawareness_get_training_campaign_details","deprecated":false},{"title":"/v1/security-awareness/phishing/simulations/{phishingSimulationId}","summary":"Get Phishing Simulation Details","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/securityawareness/securityawareness_get_phishing_simulation_details","deprecated":false},{"title":"/v1/security-awareness/users/{userId}","summary":"Get User Details","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/securityawareness/securityawareness_get_user_details","deprecated":false}]}]}]}]}},{"type":"group","label":"Security Information & Event Management (SIEM)","link":"/api-reference/connectors/siem","routeSlug":"/api-reference/connectors/siem","items":[{"label":"Query Investigations","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/siem/siem_query_investigations","routeSlug":"/api-reference/connectors/siem/siem_query_investigations","metadata":{"seo":{"title":"Query Investigations","description":"Queries investigations"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"siem_query_investigations","name":"Query Investigations","isWebhook":false,"pointer":"/paths/~1v1~1siem~1investigations/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Investigations","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Queries investigations"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"siem_query_investigations"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Cursor to use to retrieve the next page of results."},{"name":"limit","in":"query","schemaId":"schema_1","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Number of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Investigation"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects to return in this page. Defaults to 100."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"order","in":"query","schemaId":"schema_0","description":"Select a field to order the results by."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/siem/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the SIEM in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1siem~1investigations/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/siem/investigations","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/siem/investigations","href":"siem/siem_query_investigations","openApiOperationId":"siem_query_investigations","summary":"Query Investigations"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryInvestigationResponse"}},"schemaId":"components/schemas/QueryInvestigationResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1siem~1investigations/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryInvestigationResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryInvestigationResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/siem/siem_query_investigations"}],"panels":[]}]},"httpPath":"/v1/siem/investigations"},{"label":"Get Investigation","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/siem/siem_get_investigation","routeSlug":"/api-reference/connectors/siem/siem_get_investigation","metadata":{"seo":{"title":"Get Investigation","description":"Retrieves an investigation by ID."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"siem_get_investigation","name":"Get Investigation","isWebhook":false,"pointer":"/paths/~1v1~1siem~1investigations~1{id}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Investigation","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Retrieves an investigation by ID."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"siem_get_investigation"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"id","in":"path","schemaId":"schema_9","description":"ID of the investigation to retrieve.","required":true}],"pointer":"/paths/~1v1~1siem~1investigations~1{id}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the SIEM in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1siem~1investigations~1{id}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/siem/investigations/{id}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"id","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/siem/investigations/{id}","href":"siem/siem_get_investigation","openApiOperationId":"siem_get_investigation","summary":"Get Investigation"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetInvestigationResponse"}},"schemaId":"components/schemas/GetInvestigationResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1siem~1investigations~1{id}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetInvestigationResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetInvestigationResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/siem/siem_get_investigation"}],"panels":[]}]},"httpPath":"/v1/siem/investigations/{id}"},{"label":"Patch Investigation","deprecated":false,"httpVerb":"patch","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/siem/siem_patch_investigation","routeSlug":"/api-reference/connectors/siem/siem_patch_investigation","metadata":{"seo":{"title":"Patch Investigation","description":"Updates an investigation by ID."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"siem_patch_investigation","name":"Patch Investigation","isWebhook":false,"pointer":"/paths/~1v1~1siem~1investigations~1{id}/patch","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Patch Investigation","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Updates an investigation by ID."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"siem_patch_investigation"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"id","in":"path","schemaId":"schema_9","description":"ID of the investigation to update.","required":true}],"pointer":"/paths/~1v1~1siem~1investigations~1{id}/patch/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1siem~1investigations~1{id}/patch/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/PatchInvestigationRequest"}},"schemaId":"components/schemas/PatchInvestigationRequest","pointer":"/paths/~1v1~1siem~1investigations~1{id}/patch/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"PATCH","path":"/v1/siem/investigations/{id}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"id","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/PatchInvestigationRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/siem/investigations/{id}","href":"siem/siem_patch_investigation","openApiOperationId":"siem_patch_investigation","summary":"Patch Investigation"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/PatchInvestigationRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/PatchInvestigationRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetInvestigationResponse"}},"schemaId":"components/schemas/GetInvestigationResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1siem~1investigations~1{id}/patch/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetInvestigationResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetInvestigationResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/siem/siem_patch_investigation"}],"panels":[]}]},"httpPath":"/v1/siem/investigations/{id}"},{"label":"Get Evidence","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/siem/siem_get_evidence","routeSlug":"/api-reference/connectors/siem/siem_get_evidence","metadata":{"seo":{"title":"Get Evidence","description":"Retrieves the evidence for an investigation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"siem_get_evidence","name":"Get Evidence","isWebhook":false,"pointer":"/paths/~1v1~1siem~1investigations~1{id}~1evidence/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Evidence","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Retrieves the evidence for an investigation."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"siem_get_evidence"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"id","in":"path","schemaId":"schema_9","description":"ID of the investigation to retrieve evidence for.","required":true}],"pointer":"/paths/~1v1~1siem~1investigations~1{id}~1evidence/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the SIEM in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1siem~1investigations~1{id}~1evidence/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/siem/investigations/{id}/evidence","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"id","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/siem/investigations/{id}/evidence","href":"siem/siem_get_evidence","openApiOperationId":"siem_get_evidence","summary":"Get Evidence"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetEvidenceResponse"}},"schemaId":"components/schemas/GetEvidenceResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1siem~1investigations~1{id}~1evidence/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetEvidenceResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetEvidenceResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/siem/siem_get_evidence"}],"panels":[]}]},"httpPath":"/v1/siem/investigations/{id}/evidence"},{"label":"Query Log Providers","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/siem/siem_query_log_providers","routeSlug":"/api-reference/connectors/siem/siem_query_log_providers","metadata":{"seo":{"title":"Query Log Providers","description":"Queries available log providers in the source SIEM"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"siem_query_log_providers","name":"Query Log Providers","isWebhook":false,"pointer":"/paths/~1v1~1siem~1log-providers/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Log Providers","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Queries available log providers in the source SIEM"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"siem_query_log_providers"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Cursor to use to retrieve the next page of results."},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of log provider objects to return in this page. Defaults to 100."}],"pointer":"/paths/~1v1~1siem~1log-providers/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/siem/log-providers","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/siem/log-providers","href":"siem/siem_query_log_providers","openApiOperationId":"siem_query_log_providers","summary":"Query Log Providers"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryLogProvidersResponse"}},"schemaId":"components/schemas/QueryLogProvidersResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1siem~1log-providers/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryLogProvidersResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryLogProvidersResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/siem/siem_query_log_providers"}],"panels":[]}]},"httpPath":"/v1/siem/log-providers"},{"label":"Post Events","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/siem/siem_post_events","routeSlug":"/api-reference/connectors/siem/siem_post_events","metadata":{"seo":{"title":"Post Events","description":"Writes a batch of Event objects to the SIEM configured with the token used for authentication."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"siem_post_events","name":"Post Events","isWebhook":false,"pointer":"/paths/~1v1~1siem~1events/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Post Events","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Writes a batch of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Event"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects to the SIEM configured with the token used for authentication."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"siem_post_events"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1siem~1events/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_29"}},"schemaId":"schema_29","pointer":"/paths/~1v1~1siem~1events/post/requestBody","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Event"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object to be sent."},"children":[],"type":"text"}],"type":"paragraph"}]}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/siem/events","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"schema_29"}},"responseCodes":["202","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/siem/events","href":"siem/siem_post_events","openApiOperationId":"siem_post_events","summary":"Post Events"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"schema_29","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_29"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"202","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateSiemEventsResponse"}},"schemaId":"components/schemas/CreateSiemEventsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1siem~1events/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"202","schemaId":"components/schemas/CreateSiemEventsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateSiemEventsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/siem/siem_post_events"}],"panels":[]}]},"httpPath":"/v1/siem/events"},{"label":"Query Events","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/siem/siem_query_events","routeSlug":"/api-reference/connectors/siem/siem_query_events","metadata":{"seo":{"title":"Query Events","description":"Queries events from the SIEM configured with the token used for authentication."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"siem_query_events","name":"Query Events","isWebhook":false,"pointer":"/paths/~1v1~1siem~1events/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Events","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Queries events from the SIEM configured with the token used for authentication."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"siem_query_events"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"cursor","in":"query","schemaId":"schema_2","description":"Cursor to use to retrieve the next page of results."},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of events to return per page. Defaults to 100 with a maximum of 5000. If a provider has a maximum limit lower than 5000, the provider's maximum limit will be used instead."},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" descending (newest first). To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in descending order. Bare "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"order=time"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is descending. May be used multiple times to order by multiple fields, and the ordering is applied in the order the fields are specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/siem/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"passthrough-param","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Provider-specific query to pass through to the SIEM. This is useful for advanced queries that are not"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"supported by the API. The keys and values are provider-specific. For example, to perform a specific"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"query in Rapid7 IDR, you can use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"query: \"{advanced query}\""},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" key-value pair."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the SIEM in the response. This is useful for debugging and troubleshooting. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1siem~1events/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/siem/events","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"passthrough-param","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/siem/events","href":"siem/siem_query_events","openApiOperationId":"siem_query_events","summary":"Query Events"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QuerySiemEventsResponse"}},"schemaId":"components/schemas/QuerySiemEventsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1siem~1events/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QuerySiemEventsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QuerySiemEventsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/siem/siem_query_events"}],"panels":[]}]},"httpPath":"/v1/siem/events"},{"label":"Query Alerts","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/siem/siem_query_alerts","routeSlug":"/api-reference/connectors/siem/siem_query_alerts","metadata":{"seo":{"title":"Query Alerts","description":"Queries alerts from the SIEM configured with the token used for authentication."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"siem_query_alerts","name":"Query Alerts","isWebhook":false,"pointer":"/paths/~1v1~1siem~1alerts/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Alerts","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Queries alerts from the SIEM configured with the token used for authentication."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"siem_query_alerts"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"cursor","in":"query","schemaId":"schema_2","description":"Cursor to use to retrieve the next page of results."},{"name":"limit","in":"query","schemaId":"schema_1","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Number of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Account"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects to return in this page. Defaults to 100."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in descending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified. May be used multiple times to order by multiple fields, and the ordering is applied in the order the fields are specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/siem/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the SIEM in the response. This is useful for debugging and troubleshooting. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1siem~1alerts/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/siem/alerts","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/siem/alerts","href":"siem/siem_query_alerts","openApiOperationId":"siem_query_alerts","summary":"Query Alerts"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QuerySiemAlertsResponse"}},"schemaId":"components/schemas/QuerySiemAlertsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1siem~1alerts/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QuerySiemAlertsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QuerySiemAlertsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/siem/siem_query_alerts"}],"panels":[]}]},"httpPath":"/v1/siem/alerts"},{"label":"Get Alert","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/siem/siem_get_alert","routeSlug":"/api-reference/connectors/siem/siem_get_alert","metadata":{"seo":{"title":"Get Alert","description":"Retrieves an alert by ID."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"siem_get_alert","name":"Get Alert","isWebhook":false,"pointer":"/paths/~1v1~1siem~1alerts~1{id}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Alert","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Retrieves an alert by ID."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"siem_get_alert"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"id","in":"path","schemaId":"schema_9","description":"ID of the alert to retrieve.","required":true}],"pointer":"/paths/~1v1~1siem~1alerts~1{id}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the SIEM in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1siem~1alerts~1{id}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/siem/alerts/{id}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"id","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/siem/alerts/{id}","href":"siem/siem_get_alert","openApiOperationId":"siem_get_alert","summary":"Get Alert"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetAlertResponse"}},"schemaId":"components/schemas/GetAlertResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1siem~1alerts~1{id}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetAlertResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetAlertResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/siem/siem_get_alert"}],"panels":[]}]},"httpPath":"/v1/siem/alerts/{id}"},{"label":"Update Alert","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/siem/siem_update_alert","routeSlug":"/api-reference/connectors/siem/siem_update_alert","metadata":{"seo":{"title":"Update Alert","description":"Updates the triage state of a single alert in the token-linked SIEM: its lifecycle status, the analyst verdict, a comment and who it is assigned to."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"siem_update_alert","name":"Update Alert","isWebhook":false,"pointer":"/paths/~1v1~1siem~1alerts~1{id}/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Update Alert","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Updates the triage state of a single alert in the token-linked SIEM: its lifecycle status, the analyst verdict, a comment and who it is assigned to."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"siem_update_alert"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"id","in":"path","schemaId":"schema_9","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Uid of the alert (URL encoded). This will be "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info.uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in the OCSF model, as Query Alerts and Get Alert return it."},"children":[],"type":"text"}],"type":"paragraph"}],"required":true}],"pointer":"/paths/~1v1~1siem~1alerts~1{id}/post/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1siem~1alerts~1{id}/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/UpdateAlertRequest"}},"schemaId":"components/schemas/UpdateAlertRequest","pointer":"/paths/~1v1~1siem~1alerts~1{id}/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/siem/alerts/{id}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"id","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/UpdateAlertRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/siem/alerts/{id}","href":"siem/siem_update_alert","openApiOperationId":"siem_update_alert","summary":"Update Alert"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/UpdateAlertRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/UpdateAlertRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/UpdateAlertResponse"}},"schemaId":"components/schemas/UpdateAlertResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1siem~1alerts~1{id}/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/UpdateAlertResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/UpdateAlertResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/siem/siem_update_alert"}],"panels":[]}]},"httpPath":"/v1/siem/alerts/{id}"}],"content":{"contentType":"group","meta":{"name":"Siem"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Security Information & Event Management (SIEM)","showPageActions":true}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/siem/investigations","summary":"Query Investigations","prefix":{"name":"get","color":"get"},"badges":[],"link":"/siem/siem_query_investigations","deprecated":false},{"title":"/v1/siem/investigations/{id}","summary":"Get Investigation","prefix":{"name":"get","color":"get"},"badges":[],"link":"/siem/siem_get_investigation","deprecated":false},{"title":"/v1/siem/investigations/{id}","summary":"Patch Investigation","prefix":{"name":"patch","color":"patch"},"badges":[],"link":"/siem/siem_patch_investigation","deprecated":false},{"title":"/v1/siem/investigations/{id}/evidence","summary":"Get Evidence","prefix":{"name":"get","color":"get"},"badges":[],"link":"/siem/siem_get_evidence","deprecated":false},{"title":"/v1/siem/log-providers","summary":"Query Log Providers","prefix":{"name":"get","color":"get"},"badges":[],"link":"/siem/siem_query_log_providers","deprecated":false},{"title":"/v1/siem/events","summary":"Post Events","prefix":{"name":"post","color":"post"},"badges":[],"link":"/siem/siem_post_events","deprecated":false},{"title":"/v1/siem/events","summary":"Query Events","prefix":{"name":"get","color":"get"},"badges":[],"link":"/siem/siem_query_events","deprecated":false},{"title":"/v1/siem/alerts","summary":"Query Alerts","prefix":{"name":"get","color":"get"},"badges":[],"link":"/siem/siem_query_alerts","deprecated":false},{"title":"/v1/siem/alerts/{id}","summary":"Get Alert","prefix":{"name":"get","color":"get"},"badges":[],"link":"/siem/siem_get_alert","deprecated":false},{"title":"/v1/siem/alerts/{id}","summary":"Update Alert","prefix":{"name":"post","color":"post"},"badges":[],"link":"/siem/siem_update_alert","deprecated":false}]}]}]}]}},{"type":"group","label":"Sink","link":"/api-reference/connectors/sink","routeSlug":"/api-reference/connectors/sink","items":[{"label":"Post Events","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/sink/sink_post_events","routeSlug":"/api-reference/connectors/sink/sink_post_events","metadata":{"seo":{"title":"Post Events","description":"Writes a batch of Event objects to the Sink configured with the token used for authentication."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"sink_post_events","name":"Post Events","isWebhook":false,"pointer":"/paths/~1v1~1sink~1events/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Post Events","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Writes a batch of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Event"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects to the Sink configured with the token used for authentication."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"sink_post_events"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"location","in":"query","schemaId":"schema_2","description":"Updates the path or queue name for the sink. If not provided, the default path or queue name is used. When provided, the path or queue name is appended to the default path or queue name."}],"pointer":"/paths/~1v1~1sink~1events/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_29"}},"schemaId":"schema_29","pointer":"/paths/~1v1~1sink~1events/post/requestBody","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Event"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object to be sent."},"children":[],"type":"text"}],"type":"paragraph"}]}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/sink/events","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"location","in":"query","required":false,"schemaId":"schema_2"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"schema_29"}},"responseCodes":["202","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/sink/events","href":"sink/sink_post_events","openApiOperationId":"sink_post_events","summary":"Post Events"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"schema_29","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_29"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"202","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateSinkEventsResponse"}},"schemaId":"components/schemas/CreateSinkEventsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1sink~1events/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"202","schemaId":"components/schemas/CreateSinkEventsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateSinkEventsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/sink/sink_post_events"}],"panels":[]}]},"httpPath":"/v1/sink/events"}],"content":{"contentType":"group","meta":{"name":"Sink"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Sink","showPageActions":true}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/sink/events","summary":"Post Events","prefix":{"name":"post","color":"post"},"badges":[],"link":"/sink/sink_post_events","deprecated":false}]}]}]}]}},{"type":"group","label":"Ssf","link":"/api-reference/connectors/ssf","routeSlug":"/api-reference/connectors/ssf","items":[{"label":"Post Event","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ssf/ssf_post_event","routeSlug":"/api-reference/connectors/ssf/ssf_post_event","metadata":{"seo":{"title":"Post Event","description":"Signs a security signal as a Security Event Token and delivers it to the receiver configured with the token used for authentication. A success response means the receiver accepted the token. It does not mean the receiver acted on it."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ssf_post_event","name":"Post Event","isWebhook":false,"pointer":"/paths/~1v1~1ssf~1events/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Post Event","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Signs a security signal as a Security Event Token and delivers it to the receiver configured with the token used for authentication. A success response means the receiver accepted the token. It does not mean the receiver acted on it."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ssf_post_event"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ssf~1events/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_22"}},"schemaId":"schema_22","pointer":"/paths/~1v1~1ssf~1events/post/requestBody","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The security signal. Supply the subject as a top-level "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"sub_id"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and the event under "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"events"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", keyed by event type URI. If you declare a mapping on this operation, post your own format instead: the mapping runs first, and its output is what must be a valid Security Event Token."},"children":[],"type":"text"}],"type":"paragraph"}]}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/ssf/events","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"schema_22"}},"responseCodes":["202","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ssf/events","href":"ssf/ssf_post_event","openApiOperationId":"ssf_post_event","summary":"Post Event"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"schema_22","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_22"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"202","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateSsfEventResponse"}},"schemaId":"components/schemas/CreateSsfEventResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ssf~1events/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"202","schemaId":"components/schemas/CreateSsfEventResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateSsfEventResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ssf/ssf_post_event"}],"panels":[]}]},"httpPath":"/v1/ssf/events"},{"label":"Get Transmitter URLs","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ssf/ssf_get_transmitter_urls","routeSlug":"/api-reference/connectors/ssf/ssf_get_transmitter_urls","metadata":{"seo":{"title":"Get Transmitter URLs","description":"Returns the URLs to register with the receiver: the Issuer URL and the JWKS URL, and the discovery URL for receivers that take one instead. Synqly composes all three from the deployment's base URL and the integration ID, so they always agree with each other."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ssf_get_transmitter_urls","name":"Get Transmitter URLs","isWebhook":false,"pointer":"/paths/~1v1~1ssf~1transmitter~1urls/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Transmitter URLs","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns the URLs to register with the receiver: the Issuer URL and the JWKS URL, and the discovery URL for receivers that take one instead. Synqly composes all three from the deployment's base URL and the integration ID, so they always agree with each other."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ssf_get_transmitter_urls"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ssf~1transmitter~1urls/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/ssf/transmitter/urls","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ssf/transmitter/urls","href":"ssf/ssf_get_transmitter_urls","openApiOperationId":"ssf_get_transmitter_urls","summary":"Get Transmitter URLs"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetSsfTransmitterUrlsResponse"}},"schemaId":"components/schemas/GetSsfTransmitterUrlsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ssf~1transmitter~1urls/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetSsfTransmitterUrlsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetSsfTransmitterUrlsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ssf/ssf_get_transmitter_urls"}],"panels":[]}]},"httpPath":"/v1/ssf/transmitter/urls"}],"content":{"contentType":"group","meta":{"name":"Ssf"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Ssf","showPageActions":true}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/ssf/events","summary":"Post Event","prefix":{"name":"post","color":"post"},"badges":[],"link":"/ssf/ssf_post_event","deprecated":false},{"title":"/v1/ssf/transmitter/urls","summary":"Get Transmitter URLs","prefix":{"name":"get","color":"get"},"badges":[],"link":"/ssf/ssf_get_transmitter_urls","deprecated":false}]}]}]}]}},{"type":"group","label":"Storage","link":"/api-reference/connectors/storage","routeSlug":"/api-reference/connectors/storage","items":[{"label":"List Files","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/storage/storage_list_files","routeSlug":"/api-reference/connectors/storage/storage_list_files","metadata":{"seo":{"title":"List Files","description":"Returns a list of contents from the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"storage_list_files","name":"List Files","isWebhook":false,"pointer":"/paths/~1v1~1storage~1folders~1{path}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"List Files","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of contents from the token-linked "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Integration"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"storage_list_files"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"path","in":"path","schemaId":"schema_9","required":true}],"pointer":"/paths/~1v1~1storage~1folders~1{path}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Cursor to fetch the next set of results."},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of results to return. Default is 50."}],"pointer":"/paths/~1v1~1storage~1folders~1{path}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/storage/folders/{path}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"path","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/storage/folders/{path}","href":"storage/storage_list_files","openApiOperationId":"storage_list_files","summary":"List Files"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListStorageResponse"}},"schemaId":"components/schemas/ListStorageResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1storage~1folders~1{path}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ListStorageResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListStorageResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/storage/storage_list_files"}],"panels":[]}]},"httpPath":"/v1/storage/folders/{path}"},{"label":"Upload File","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/storage/storage_upload_file","routeSlug":"/api-reference/connectors/storage/storage_upload_file","metadata":{"seo":{"title":"Upload File","description":"Uploads a file from the provided {path} to the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"storage_upload_file","name":"Upload File","isWebhook":false,"pointer":"/paths/~1v1~1storage~1files~1{path}/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Upload File","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Uploads a file from the provided "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{path}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the token-linked "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Integration"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"storage_upload_file"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"path","in":"path","schemaId":"schema_9","required":true}],"pointer":"/paths/~1v1~1storage~1files~1{path}/post/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1storage~1files~1{path}/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["multipart/form-data"],"mediaTypeSchemas":{"multipart/form-data":{"schemaId":"schema_30"}},"schemaId":"schema_30","pointer":"/paths/~1v1~1storage~1files~1{path}/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/storage/files/{path}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"path","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"multipart/form-data":{"schemaId":"schema_30"}},"responseCodes":["204","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/storage/files/{path}","href":"storage/storage_upload_file","openApiOperationId":"storage_upload_file","summary":"Upload File"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"schema_30","mediaTypes":["multipart/form-data"],"mediaTypeSchemas":{"multipart/form-data":{"schemaId":"schema_30"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1storage~1files~1{path}/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"204"},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/storage/storage_upload_file"}],"panels":[]}]},"httpPath":"/v1/storage/files/{path}"},{"label":"Download File","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/storage/storage_download_file","routeSlug":"/api-reference/connectors/storage/storage_download_file","metadata":{"seo":{"title":"Download File","description":"Downloads a file from the provided {path} in the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"storage_download_file","name":"Download File","isWebhook":false,"pointer":"/paths/~1v1~1storage~1files~1{path}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Download File","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Downloads a file from the provided "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{path}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in the token-linked "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Integration"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"storage_download_file"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"path","in":"path","schemaId":"schema_9","required":true}],"pointer":"/paths/~1v1~1storage~1files~1{path}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/storage/files/{path}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"path","in":"path","required":true,"schemaId":"schema_9"}],"query":[],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/storage/files/{path}","href":"storage/storage_download_file","openApiOperationId":"storage_download_file","summary":"Download File"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","description":"File contents.","mediaType":"application/octet-stream","mediaTypes":["application/octet-stream"],"mediaTypeContent":{"application/octet-stream":{"schemaId":"schema_31"}},"schemaId":"schema_31"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1storage~1files~1{path}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"schema_31","mediaTypes":["application/octet-stream"],"mediaTypeContent":{"application/octet-stream":{"schemaId":"schema_31"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/storage/storage_download_file"}],"panels":[]}]},"httpPath":"/v1/storage/files/{path}"},{"label":"Delete File","deprecated":false,"httpVerb":"delete","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/storage/storage_delete_file","routeSlug":"/api-reference/connectors/storage/storage_delete_file","metadata":{"seo":{"title":"Delete File","description":"Deletes a file from the provided {path} in the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"storage_delete_file","name":"Delete File","isWebhook":false,"pointer":"/paths/~1v1~1storage~1files~1{path}/delete","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Delete File","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Deletes a file from the provided "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{path}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in the token-linked "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Integration"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"storage_delete_file"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"path","in":"path","schemaId":"schema_9","required":true}],"pointer":"/paths/~1v1~1storage~1files~1{path}/delete/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1storage~1files~1{path}/delete/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"DELETE","path":"/v1/storage/files/{path}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"path","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["204","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/storage/files/{path}","href":"storage/storage_delete_file","openApiOperationId":"storage_delete_file","summary":"Delete File"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1storage~1files~1{path}/delete/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"204"},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/storage/storage_delete_file"}],"panels":[]}]},"httpPath":"/v1/storage/files/{path}"}],"content":{"contentType":"group","meta":{"name":"Storage"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Storage","showPageActions":true}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/storage/folders/{path}","summary":"List Files","prefix":{"name":"get","color":"get"},"badges":[],"link":"/storage/storage_list_files","deprecated":false},{"title":"/v1/storage/files/{path}","summary":"Upload File","prefix":{"name":"post","color":"post"},"badges":[],"link":"/storage/storage_upload_file","deprecated":false},{"title":"/v1/storage/files/{path}","summary":"Download File","prefix":{"name":"get","color":"get"},"badges":[],"link":"/storage/storage_download_file","deprecated":false},{"title":"/v1/storage/files/{path}","summary":"Delete File","prefix":{"name":"delete","color":"delete"},"badges":[],"link":"/storage/storage_delete_file","deprecated":false}]}]}]}]}},{"type":"group","label":"Threat Intelligence (In Development)","link":"/api-reference/connectors/threatintel","routeSlug":"/api-reference/connectors/threatintel","items":[{"label":"Lookup Hash","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/threatintel/threatintel_lookup_hash","routeSlug":"/api-reference/connectors/threatintel/threatintel_lookup_hash","metadata":{"seo":{"title":"Lookup Hash","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"threatintel_lookup_hash","name":"Lookup Hash","isWebhook":false,"pointer":"/paths/~1v1~1threat-intel~1lookup~1hash/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Lookup Hash","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Looks up a file hash against the token-linked threat intelligence source and returns normalized reputation and context. MD5, SHA-1, and SHA-256 hashes are supported; the hash type is detected from the value. A lookup that finds no intel records is a successful response with an empty "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"osint"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" array."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"threatintel_lookup_hash"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1threat-intel~1lookup~1hash/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_32"}},"schemaId":"schema_32","pointer":"/paths/~1v1~1threat-intel~1lookup~1hash/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/threat-intel/lookup/hash","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"schema_32"}},"responseCodes":["200","400","401","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/threat-intel/lookup/hash","href":"threatintel/threatintel_lookup_hash","openApiOperationId":"threatintel_lookup_hash","summary":"Lookup Hash"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"schema_32","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_32"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ThreatIntelLookupHashResponse"}},"schemaId":"components/schemas/ThreatIntelLookupHashResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1threat-intel~1lookup~1hash/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ThreatIntelLookupHashResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ThreatIntelLookupHashResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/threatintel/threatintel_lookup_hash"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/threat-intel/lookup/hash"},{"label":"Lookup URL","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/threatintel/threatintel_lookup_url","routeSlug":"/api-reference/connectors/threatintel/threatintel_lookup_url","metadata":{"seo":{"title":"Lookup URL","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"threatintel_lookup_url","name":"Lookup URL","isWebhook":false,"pointer":"/paths/~1v1~1threat-intel~1lookup~1url/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Lookup URL","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Looks up a URL against the token-linked threat intelligence source and returns normalized reputation and context. Note that the looked-up URL is disclosed to the third-party intelligence provider; avoid looking up URLs that embed secrets (for example, signed URLs) unless that disclosure is acceptable. A lookup that finds no intel records is a successful response with an empty "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"osint"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" array."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"threatintel_lookup_url"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1threat-intel~1lookup~1url/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_33"}},"schemaId":"schema_33","pointer":"/paths/~1v1~1threat-intel~1lookup~1url/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/threat-intel/lookup/url","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"schema_33"}},"responseCodes":["200","400","401","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/threat-intel/lookup/url","href":"threatintel/threatintel_lookup_url","openApiOperationId":"threatintel_lookup_url","summary":"Lookup URL"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"schema_33","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_33"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ThreatIntelLookupUrlResponse"}},"schemaId":"components/schemas/ThreatIntelLookupUrlResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1threat-intel~1lookup~1url/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ThreatIntelLookupUrlResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ThreatIntelLookupUrlResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/threatintel/threatintel_lookup_url"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/threat-intel/lookup/url"},{"label":"Lookup Domain","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/threatintel/threatintel_lookup_domain","routeSlug":"/api-reference/connectors/threatintel/threatintel_lookup_domain","metadata":{"seo":{"title":"Lookup Domain","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"threatintel_lookup_domain","name":"Lookup Domain","isWebhook":false,"pointer":"/paths/~1v1~1threat-intel~1lookup~1domain/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Lookup Domain","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Looks up a domain name against the token-linked threat intelligence source and returns normalized reputation and context. Note that the looked-up domain is disclosed to the third-party intelligence provider, which can reveal internal hostnames. A lookup that finds no intel records is a successful response with an empty "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"osint"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" array."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"threatintel_lookup_domain"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1threat-intel~1lookup~1domain/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_34"}},"schemaId":"schema_34","pointer":"/paths/~1v1~1threat-intel~1lookup~1domain/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/threat-intel/lookup/domain","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"schema_34"}},"responseCodes":["200","400","401","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/threat-intel/lookup/domain","href":"threatintel/threatintel_lookup_domain","openApiOperationId":"threatintel_lookup_domain","summary":"Lookup Domain"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"schema_34","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_34"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ThreatIntelLookupDomainResponse"}},"schemaId":"components/schemas/ThreatIntelLookupDomainResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1threat-intel~1lookup~1domain/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ThreatIntelLookupDomainResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ThreatIntelLookupDomainResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/threatintel/threatintel_lookup_domain"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/threat-intel/lookup/domain"},{"label":"Lookup IP","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/threatintel/threatintel_lookup_ip","routeSlug":"/api-reference/connectors/threatintel/threatintel_lookup_ip","metadata":{"seo":{"title":"Lookup IP","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"threatintel_lookup_ip","name":"Lookup IP","isWebhook":false,"pointer":"/paths/~1v1~1threat-intel~1lookup~1ip/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Lookup IP","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Looks up an IPv4 or IPv6 address against the token-linked threat intelligence source and returns normalized reputation and context. A lookup that finds no intel records is a successful response with an empty "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"osint"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" array."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"threatintel_lookup_ip"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1threat-intel~1lookup~1ip/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_35"}},"schemaId":"schema_35","pointer":"/paths/~1v1~1threat-intel~1lookup~1ip/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/threat-intel/lookup/ip","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"schema_35"}},"responseCodes":["200","400","401","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/threat-intel/lookup/ip","href":"threatintel/threatintel_lookup_ip","openApiOperationId":"threatintel_lookup_ip","summary":"Lookup IP"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"schema_35","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_35"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ThreatIntelLookupIpResponse"}},"schemaId":"components/schemas/ThreatIntelLookupIpResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1threat-intel~1lookup~1ip/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ThreatIntelLookupIpResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ThreatIntelLookupIpResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/threatintel/threatintel_lookup_ip"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/threat-intel/lookup/ip"}],"content":{"contentType":"group","meta":{"name":"Threatintel"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Threat Intelligence (In Development)","showPageActions":true},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This feature is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this feature."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"}]}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/threat-intel/lookup/hash","summary":"Lookup Hash","prefix":{"name":"post","color":"post"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/threatintel/threatintel_lookup_hash","deprecated":false},{"title":"/v1/threat-intel/lookup/url","summary":"Lookup URL","prefix":{"name":"post","color":"post"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/threatintel/threatintel_lookup_url","deprecated":false},{"title":"/v1/threat-intel/lookup/domain","summary":"Lookup Domain","prefix":{"name":"post","color":"post"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/threatintel/threatintel_lookup_domain","deprecated":false},{"title":"/v1/threat-intel/lookup/ip","summary":"Lookup IP","prefix":{"name":"post","color":"post"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/threatintel/threatintel_lookup_ip","deprecated":false}]}]}]}]}},{"type":"group","label":"Ticketing","link":"/api-reference/connectors/ticketing","routeSlug":"/api-reference/connectors/ticketing","items":[{"label":"List Remote Fields","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_list_remote_fields","routeSlug":"/api-reference/connectors/ticketing/ticketing_list_remote_fields","metadata":{"seo":{"title":"List Remote Fields","description":"List all remote fields for all Projects in a ticketing integration. The response will include a list of fields for each issue type in the ticketing provider."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_list_remote_fields","name":"List Remote Fields","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1remote-fields/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"List Remote Fields","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"List all remote fields for all Projects in a ticketing integration. The response will include a list of fields for each issue type in the ticketing provider."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_list_remote_fields"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1remote-fields/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/ticketing/remote-fields","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/remote-fields","href":"ticketing/ticketing_list_remote_fields","openApiOperationId":"ticketing_list_remote_fields","summary":"List Remote Fields"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListRemoteFieldsResponse"}},"schemaId":"components/schemas/ListRemoteFieldsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1remote-fields/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ListRemoteFieldsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListRemoteFieldsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_list_remote_fields"}],"panels":[]}]},"httpPath":"/v1/ticketing/remote-fields"},{"label":"List Issue Types","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_list_issue_types","routeSlug":"/api-reference/connectors/ticketing/ticketing_list_issue_types","metadata":{"seo":{"title":"List Issue Types","description":"List issue types for the specified project."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_list_issue_types","name":"List Issue Types","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1issue-types~1{projectId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"List Issue Types","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"List issue types for the specified project."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_list_issue_types"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"projectId","in":"path","schemaId":"schema_36","description":"Project to list issue types for, as a project key or id.","required":true}],"pointer":"/paths/~1v1~1ticketing~1issue-types~1{projectId}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1issue-types~1{projectId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/ticketing/issue-types/{projectId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"projectId","in":"path","required":true,"schemaId":"schema_37"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/issue-types/{projectId}","href":"ticketing/ticketing_list_issue_types","openApiOperationId":"ticketing_list_issue_types","summary":"List Issue Types"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListIssueTypesResponse"}},"schemaId":"components/schemas/ListIssueTypesResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1issue-types~1{projectId}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ListIssueTypesResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListIssueTypesResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_list_issue_types"}],"panels":[]}]},"httpPath":"/v1/ticketing/issue-types/{projectId}"},{"label":"List Issue Type Remote Fields","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_list_issue_type_remote_fields","routeSlug":"/api-reference/connectors/ticketing/ticketing_list_issue_type_remote_fields","metadata":{"seo":{"title":"List Issue Type Remote Fields","description":"Lists the remote fields available when creating a ticket in the specified project, using the specified issue type."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_list_issue_type_remote_fields","name":"List Issue Type Remote Fields","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1remote-fields~1{projectId}~1{issueTypeId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"List Issue Type Remote Fields","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Lists the remote fields available when creating a ticket in the specified project, using the specified issue type."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_list_issue_type_remote_fields"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"projectId","in":"path","schemaId":"schema_36","description":"Project the issue type belongs to, as a project key or id.","required":true},{"name":"issueTypeId","in":"path","schemaId":"schema_38","description":"Issue type ID as returned when listing issue types.","required":true}],"pointer":"/paths/~1v1~1ticketing~1remote-fields~1{projectId}~1{issueTypeId}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1remote-fields~1{projectId}~1{issueTypeId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/ticketing/remote-fields/{projectId}/{issueTypeId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"projectId","in":"path","required":true,"schemaId":"schema_37"},{"name":"issueTypeId","in":"path","required":true,"schemaId":"components/schemas/IssueTypeId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/remote-fields/{projectId}/{issueTypeId}","href":"ticketing/ticketing_list_issue_type_remote_fields","openApiOperationId":"ticketing_list_issue_type_remote_fields","summary":"List Issue Type Remote Fields"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListRemoteFieldsResponse"}},"schemaId":"components/schemas/ListRemoteFieldsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1remote-fields~1{projectId}~1{issueTypeId}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ListRemoteFieldsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListRemoteFieldsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_list_issue_type_remote_fields"}],"panels":[]}]},"httpPath":"/v1/ticketing/remote-fields/{projectId}/{issueTypeId}"},{"label":"List Projects","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_list_projects","routeSlug":"/api-reference/connectors/ticketing/ticketing_list_projects","metadata":{"seo":{"title":"List Projects","description":"Returns a list of Projects from the token-linked Integration. Tickets must be created and retrieved within the context of a specific Project."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_list_projects","name":"List Projects","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1projects/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"List Projects","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Projects"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from the token-linked "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Integration"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Tickets must be created and retrieved within the context of a specific Project."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_list_projects"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Cursor to use to retrieve the next page of results."},{"name":"limit","in":"query","schemaId":"schema_1","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Number of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Projects"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects to return in this page. Defaults to 50."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1projects/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/ticketing/projects","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/projects","href":"ticketing/ticketing_list_projects","openApiOperationId":"ticketing_list_projects","summary":"List Projects"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListProjectsResponse"}},"schemaId":"components/schemas/ListProjectsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1projects/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ListProjectsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListProjectsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_list_projects"}],"panels":[]}]},"httpPath":"/v1/ticketing/projects"},{"label":"Query Tickets","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_query_tickets","routeSlug":"/api-reference/connectors/ticketing/ticketing_query_tickets","metadata":{"seo":{"title":"Query Tickets","description":"Returns a list of Ticket objects from the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_query_tickets","name":"Query Tickets","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1tickets/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Tickets","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Ticket"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects from the token-linked "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Integration"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_query_tickets"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Cursor to use to retrieve the next page of results."},{"name":"limit","in":"query","schemaId":"schema_1","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Number of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Account"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects to return in this page. Defaults to 100."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"order","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Select a field to order the results by. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". To control the direction of the sorting, append "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[asc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to the field name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name[desc]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" will sort the results by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in descending order. The ordering defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"asc"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if not specified. May be used multiple times to order by multiple fields, and the ordering is applied in the order the fields are specified."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/ticketing/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1tickets/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/ticketing/tickets","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"order","in":"query","required":false,"schemaId":"schema_0"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/tickets","href":"ticketing/ticketing_query_tickets","openApiOperationId":"ticketing_query_tickets","summary":"Query Tickets"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryTicketsResponse"}},"schemaId":"components/schemas/QueryTicketsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1tickets/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryTicketsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryTicketsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_query_tickets"}],"panels":[]}]},"httpPath":"/v1/ticketing/tickets"},{"label":"Create Ticket","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_create_ticket","routeSlug":"/api-reference/connectors/ticketing/ticketing_create_ticket","metadata":{"seo":{"title":"Create Ticket","description":"Creates a Ticket object in the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_create_ticket","name":"Create Ticket","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1tickets/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Create Ticket","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Creates a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Ticket"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object in the token-linked Integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_create_ticket"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1tickets/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateTicketRequest"}},"schemaId":"components/schemas/CreateTicketRequest","pointer":"/paths/~1v1~1ticketing~1tickets/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/ticketing/tickets","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/CreateTicketRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/tickets","href":"ticketing/ticketing_create_ticket","openApiOperationId":"ticketing_create_ticket","summary":"Create Ticket"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/CreateTicketRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateTicketRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateTicketResponse"}},"schemaId":"components/schemas/CreateTicketResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1tickets/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/CreateTicketResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateTicketResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_create_ticket"}],"panels":[]}]},"httpPath":"/v1/ticketing/tickets"},{"label":"Get Ticket","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_get_ticket","routeSlug":"/api-reference/connectors/ticketing/ticketing_get_ticket","metadata":{"seo":{"title":"Get Ticket","description":"Returns a Ticket object matching {ticketId} from the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_get_ticket","name":"Get Ticket","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Ticket","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Ticket"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{ticketId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from the token-linked "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Integration"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_get_ticket"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"ticketId","in":"path","schemaId":"schema_39","required":true}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/ticketing/tickets/{ticketId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"ticketId","in":"path","required":true,"schemaId":"schema_40"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/tickets/{ticketId}","href":"ticketing/ticketing_get_ticket","openApiOperationId":"ticketing_get_ticket","summary":"Get Ticket"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetTicketResponse"}},"schemaId":"components/schemas/GetTicketResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetTicketResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetTicketResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_get_ticket"}],"panels":[]}]},"httpPath":"/v1/ticketing/tickets/{ticketId}"},{"label":"Patch Ticket","deprecated":false,"httpVerb":"patch","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_patch_ticket","routeSlug":"/api-reference/connectors/ticketing/ticketing_patch_ticket","metadata":{"seo":{"title":"Patch Ticket","description":"Updates the Ticket object matching {ticketId} in the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_patch_ticket","name":"Patch Ticket","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}/patch","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Patch Ticket","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Updates the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Ticket"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{ticketId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in the token-linked "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Integration"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_patch_ticket"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"ticketId","in":"path","schemaId":"schema_39","required":true}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}/patch/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}/patch/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_41"}},"schemaId":"schema_41","pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}/patch/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"PATCH","path":"/v1/ticketing/tickets/{ticketId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"ticketId","in":"path","required":true,"schemaId":"schema_40"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"schema_41"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/tickets/{ticketId}","href":"ticketing/ticketing_patch_ticket","openApiOperationId":"ticketing_patch_ticket","summary":"Patch Ticket"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"schema_41","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_41"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/PatchTicketResponse"}},"schemaId":"components/schemas/PatchTicketResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}/patch/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/PatchTicketResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/PatchTicketResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_patch_ticket"}],"panels":[]}]},"httpPath":"/v1/ticketing/tickets/{ticketId}"},{"label":"Create Attachment","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_create_attachment","routeSlug":"/api-reference/connectors/ticketing/ticketing_create_attachment","metadata":{"seo":{"title":"Create Attachment","description":"[beta: currently supported by Jira] Creates an Attachment for the ticket with id {ticketId} in the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_create_attachment","name":"Create Attachment","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1attachments~1{ticketId}/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Create Attachment","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[beta: currently supported by Jira] Creates an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Attachment"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the ticket with id "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{ticketId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in the token-linked "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Integration"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_create_attachment"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"ticketId","in":"path","schemaId":"schema_39","required":true}],"pointer":"/paths/~1v1~1ticketing~1attachments~1{ticketId}/post/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1attachments~1{ticketId}/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateAttachmentRequest"}},"schemaId":"components/schemas/CreateAttachmentRequest","pointer":"/paths/~1v1~1ticketing~1attachments~1{ticketId}/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/ticketing/attachments/{ticketId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"ticketId","in":"path","required":true,"schemaId":"schema_40"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/CreateAttachmentRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/attachments/{ticketId}","href":"ticketing/ticketing_create_attachment","openApiOperationId":"ticketing_create_attachment","summary":"Create Attachment"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/CreateAttachmentRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateAttachmentRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateAttachmentResponse"}},"schemaId":"components/schemas/CreateAttachmentResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1attachments~1{ticketId}/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/CreateAttachmentResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateAttachmentResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_create_attachment"}],"panels":[]}]},"httpPath":"/v1/ticketing/attachments/{ticketId}"},{"label":"List Attachments Metadata","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_list_attachments_metadata","routeSlug":"/api-reference/connectors/ticketing/ticketing_list_attachments_metadata","metadata":{"seo":{"title":"List Attachments Metadata","description":"[beta: currently supported by Jira] Returns metadata for all Attachments for a Ticket object matching {ticketId} from the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_list_attachments_metadata","name":"List Attachments Metadata","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1attachments~1{ticketId}/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"List Attachments Metadata","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[beta: currently supported by Jira] Returns metadata for all Attachments for a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Ticket"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{ticketId}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from the token-linked "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Integration"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_list_attachments_metadata"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"ticketId","in":"path","schemaId":"schema_39","required":true}],"pointer":"/paths/~1v1~1ticketing~1attachments~1{ticketId}/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1attachments~1{ticketId}/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/ticketing/attachments/{ticketId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"ticketId","in":"path","required":true,"schemaId":"schema_40"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/attachments/{ticketId}","href":"ticketing/ticketing_list_attachments_metadata","openApiOperationId":"ticketing_list_attachments_metadata","summary":"List Attachments Metadata"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListAttachmentsMetadataResponse"}},"schemaId":"components/schemas/ListAttachmentsMetadataResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1attachments~1{ticketId}/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ListAttachmentsMetadataResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListAttachmentsMetadataResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_list_attachments_metadata"}],"panels":[]}]},"httpPath":"/v1/ticketing/attachments/{ticketId}"},{"label":"Download Attachment","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_download_attachment","routeSlug":"/api-reference/connectors/ticketing/ticketing_download_attachment","metadata":{"seo":{"title":"Download Attachment","description":"[beta: currently supported by Jira] Downloads the Attachment object matching {attachmentId} for the Ticket matching {tickedId} from the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_download_attachment","name":"Download Attachment","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1attachments~1{ticketId}~1{attachmentId}~1download/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Download Attachment","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[beta: currently supported by Jira] Downloads the Attachment object matching {attachmentId} for the Ticket matching {tickedId} from the token-linked Integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_download_attachment"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"ticketId","in":"path","schemaId":"schema_39","required":true},{"name":"attachmentId","in":"path","schemaId":"schema_42","required":true}],"pointer":"/paths/~1v1~1ticketing~1attachments~1{ticketId}~1{attachmentId}~1download/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1attachments~1{ticketId}~1{attachmentId}~1download/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/ticketing/attachments/{ticketId}/{attachmentId}/download","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"ticketId","in":"path","required":true,"schemaId":"schema_40"},{"name":"attachmentId","in":"path","required":true,"schemaId":"schema_43"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/attachments/{ticketId}/{attachmentId}/download","href":"ticketing/ticketing_download_attachment","openApiOperationId":"ticketing_download_attachment","summary":"Download Attachment"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/DownloadAttachmentResponse"}},"schemaId":"components/schemas/DownloadAttachmentResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1attachments~1{ticketId}~1{attachmentId}~1download/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/DownloadAttachmentResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/DownloadAttachmentResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_download_attachment"}],"panels":[]}]},"httpPath":"/v1/ticketing/attachments/{ticketId}/{attachmentId}/download"},{"label":"Delete Attachment","deprecated":false,"httpVerb":"delete","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_delete_attachment","routeSlug":"/api-reference/connectors/ticketing/ticketing_delete_attachment","metadata":{"seo":{"title":"Delete Attachment","description":"[beta: currently supported by Jira] Deletes the Attachment object matching {attachmentId} for the Ticket matching {tickedId} from the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_delete_attachment","name":"Delete Attachment","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1attachments~1{ticketId}~1{attachmentId}/delete","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Delete Attachment","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[beta: currently supported by Jira] Deletes the Attachment object matching {attachmentId} for the Ticket matching {tickedId} from the token-linked Integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_delete_attachment"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"ticketId","in":"path","schemaId":"schema_39","required":true},{"name":"attachmentId","in":"path","schemaId":"schema_42","required":true}],"pointer":"/paths/~1v1~1ticketing~1attachments~1{ticketId}~1{attachmentId}/delete/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1attachments~1{ticketId}~1{attachmentId}/delete/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"DELETE","path":"/v1/ticketing/attachments/{ticketId}/{attachmentId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"ticketId","in":"path","required":true,"schemaId":"schema_40"},{"name":"attachmentId","in":"path","required":true,"schemaId":"schema_43"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["204","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/attachments/{ticketId}/{attachmentId}","href":"ticketing/ticketing_delete_attachment","openApiOperationId":"ticketing_delete_attachment","summary":"Delete Attachment"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1attachments~1{ticketId}~1{attachmentId}/delete/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"204"},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_delete_attachment"}],"panels":[]}]},"httpPath":"/v1/ticketing/attachments/{ticketId}/{attachmentId}"},{"label":"List Comments","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_list_comments","routeSlug":"/api-reference/connectors/ticketing/ticketing_list_comments","metadata":{"seo":{"title":"List Comments","description":"Lists all comments for the ticket matching {ticketId} from the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_list_comments","name":"List Comments","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1comments/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"List Comments","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Lists all comments for the ticket matching {ticketId} from the token-linked Integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_list_comments"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"ticketId","in":"path","schemaId":"schema_39","required":true}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1comments/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1comments/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/ticketing/tickets/{ticketId}/comments","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"ticketId","in":"path","required":true,"schemaId":"schema_40"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/tickets/{ticketId}/comments","href":"ticketing/ticketing_list_comments","openApiOperationId":"ticketing_list_comments","summary":"List Comments"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListCommentsResponse"}},"schemaId":"components/schemas/ListCommentsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1comments/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ListCommentsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListCommentsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_list_comments"}],"panels":[]}]},"httpPath":"/v1/ticketing/tickets/{ticketId}/comments"},{"label":"Create Comment","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_create_comment","routeSlug":"/api-reference/connectors/ticketing/ticketing_create_comment","metadata":{"seo":{"title":"Create Comment","description":"Creates a comment on the ticket matching {ticketId} from the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_create_comment","name":"Create Comment","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1comments/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Create Comment","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Creates a comment on the ticket matching {ticketId} from the token-linked Integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_create_comment"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"ticketId","in":"path","schemaId":"schema_39","required":true}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1comments/post/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1comments/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateCommentRequest"}},"schemaId":"components/schemas/CreateCommentRequest","pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1comments/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/ticketing/tickets/{ticketId}/comments","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"ticketId","in":"path","required":true,"schemaId":"schema_40"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/CreateCommentRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/tickets/{ticketId}/comments","href":"ticketing/ticketing_create_comment","openApiOperationId":"ticketing_create_comment","summary":"Create Comment"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/CreateCommentRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateCommentRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateCommentResponse"}},"schemaId":"components/schemas/CreateCommentResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1comments/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/CreateCommentResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateCommentResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_create_comment"}],"panels":[]}]},"httpPath":"/v1/ticketing/tickets/{ticketId}/comments"},{"label":"Delete Comment","deprecated":false,"httpVerb":"delete","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_delete_comment","routeSlug":"/api-reference/connectors/ticketing/ticketing_delete_comment","metadata":{"seo":{"title":"Delete Comment","description":"Deletes the comment matching {commentId} form the ticket matching {ticketId} from the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_delete_comment","name":"Delete Comment","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1comments~1{commentId}/delete","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Delete Comment","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Deletes the comment matching {commentId} form the ticket matching {ticketId} from the token-linked Integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_delete_comment"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"ticketId","in":"path","schemaId":"schema_39","required":true},{"name":"commentId","in":"path","schemaId":"schema_44","required":true}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1comments~1{commentId}/delete/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1comments~1{commentId}/delete/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"DELETE","path":"/v1/ticketing/tickets/{ticketId}/comments/{commentId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"ticketId","in":"path","required":true,"schemaId":"schema_40"},{"name":"commentId","in":"path","required":true,"schemaId":"schema_45"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["204","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/tickets/{ticketId}/comments/{commentId}","href":"ticketing/ticketing_delete_comment","openApiOperationId":"ticketing_delete_comment","summary":"Delete Comment"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1comments~1{commentId}/delete/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"204"},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_delete_comment"}],"panels":[]}]},"httpPath":"/v1/ticketing/tickets/{ticketId}/comments/{commentId}"},{"label":"Create Note","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_create_note","routeSlug":"/api-reference/connectors/ticketing/ticketing_create_note","metadata":{"seo":{"title":"Create Note","description":"Creates a note on the ticket matching {ticketId} from the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_create_note","name":"Create Note","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1notes/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Create Note","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Creates a note on the ticket matching {ticketId} from the token-linked Integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_create_note"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"ticketId","in":"path","schemaId":"schema_39","required":true}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1notes/post/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1notes/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateNoteRequest"}},"schemaId":"components/schemas/CreateNoteRequest","pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1notes/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/ticketing/tickets/{ticketId}/notes","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"ticketId","in":"path","required":true,"schemaId":"schema_40"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/CreateNoteRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/tickets/{ticketId}/notes","href":"ticketing/ticketing_create_note","openApiOperationId":"ticketing_create_note","summary":"Create Note"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/CreateNoteRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateNoteRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateNoteResponse"}},"schemaId":"components/schemas/CreateNoteResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1notes/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/CreateNoteResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateNoteResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_create_note"}],"panels":[]}]},"httpPath":"/v1/ticketing/tickets/{ticketId}/notes"},{"label":"List Notes","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_list_notes","routeSlug":"/api-reference/connectors/ticketing/ticketing_list_notes","metadata":{"seo":{"title":"List Notes","description":"Lists all notes for the ticket matching {ticketId} from the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_list_notes","name":"List Notes","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1notes/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"List Notes","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Lists all notes for the ticket matching {ticketId} from the token-linked Integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_list_notes"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"ticketId","in":"path","schemaId":"schema_39","required":true}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1notes/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1notes/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/ticketing/tickets/{ticketId}/notes","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"ticketId","in":"path","required":true,"schemaId":"schema_40"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/tickets/{ticketId}/notes","href":"ticketing/ticketing_list_notes","openApiOperationId":"ticketing_list_notes","summary":"List Notes"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListNotesResponse"}},"schemaId":"components/schemas/ListNotesResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1notes/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ListNotesResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListNotesResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_list_notes"}],"panels":[]}]},"httpPath":"/v1/ticketing/tickets/{ticketId}/notes"},{"label":"Delete Note","deprecated":false,"httpVerb":"delete","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_delete_note","routeSlug":"/api-reference/connectors/ticketing/ticketing_delete_note","metadata":{"seo":{"title":"Delete Note","description":"Deletes the note matching {noteId} form the ticket matching {ticketId} from the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_delete_note","name":"Delete Note","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1notes~1{noteId}/delete","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Delete Note","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Deletes the note matching {noteId} form the ticket matching {ticketId} from the token-linked Integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_delete_note"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"ticketId","in":"path","schemaId":"schema_39","required":true},{"name":"noteId","in":"path","schemaId":"schema_46","required":true}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1notes~1{noteId}/delete/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1notes~1{noteId}/delete/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"DELETE","path":"/v1/ticketing/tickets/{ticketId}/notes/{noteId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"ticketId","in":"path","required":true,"schemaId":"schema_40"},{"name":"noteId","in":"path","required":true,"schemaId":"schema_47"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["204","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/tickets/{ticketId}/notes/{noteId}","href":"ticketing/ticketing_delete_note","openApiOperationId":"ticketing_delete_note","summary":"Delete Note"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1notes~1{noteId}/delete/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"204"},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_delete_note"}],"panels":[]}]},"httpPath":"/v1/ticketing/tickets/{ticketId}/notes/{noteId}"},{"label":"Patch Note","deprecated":false,"httpVerb":"patch","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_patch_note","routeSlug":"/api-reference/connectors/ticketing/ticketing_patch_note","metadata":{"seo":{"title":"Patch Note","description":"Update a note matching {noteId} title and/or content on the ticket matching {ticketId} from the token-linked Integration."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_patch_note","name":"Patch Note","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1notes~1{noteId}/patch","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Patch Note","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Update a note matching {noteId} title and/or content on the ticket matching {ticketId} from the token-linked Integration."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_patch_note"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"ticketId","in":"path","schemaId":"schema_39","required":true},{"name":"noteId","in":"path","schemaId":"schema_46","required":true}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1notes~1{noteId}/patch/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1notes~1{noteId}/patch/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_41"}},"schemaId":"schema_41","pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1notes~1{noteId}/patch/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"PATCH","path":"/v1/ticketing/tickets/{ticketId}/notes/{noteId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"ticketId","in":"path","required":true,"schemaId":"schema_40"},{"name":"noteId","in":"path","required":true,"schemaId":"schema_47"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"schema_41"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/tickets/{ticketId}/notes/{noteId}","href":"ticketing/ticketing_patch_note","openApiOperationId":"ticketing_patch_note","summary":"Patch Note"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"schema_41","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"schema_41"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/PatchNoteResponse"}},"schemaId":"components/schemas/PatchNoteResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1tickets~1{ticketId}~1notes~1{noteId}/patch/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/PatchNoteResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/PatchNoteResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_patch_note"}],"panels":[]}]},"httpPath":"/v1/ticketing/tickets/{ticketId}/notes/{noteId}"},{"label":"Query Escalation Policies","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_query_escalation_policies","routeSlug":"/api-reference/connectors/ticketing/ticketing_query_escalation_policies","metadata":{"seo":{"title":"Query Escalation Policies","description":"Returns a list of escalation policies."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_query_escalation_policies","name":"Query Escalation Policies","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1escalation-policies/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Escalation Policies","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of escalation policies."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_query_escalation_policies"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of escalation policies to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/ticketing/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1escalation-policies/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/ticketing/escalation-policies","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/escalation-policies","href":"ticketing/ticketing_query_escalation_policies","openApiOperationId":"ticketing_query_escalation_policies","summary":"Query Escalation Policies"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryEscalationPoliciesResponse"}},"schemaId":"components/schemas/QueryEscalationPoliciesResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1escalation-policies/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryEscalationPoliciesResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryEscalationPoliciesResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_query_escalation_policies"}],"panels":[]}]},"httpPath":"/v1/ticketing/escalation-policies"},{"label":"List On Call Agents","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/ticketing/ticketing_list_on_call","routeSlug":"/api-reference/connectors/ticketing/ticketing_list_on_call","metadata":{"seo":{"title":"List On Call Agents","description":"Returns a list of all on-call agents for an escalation policy."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"ticketing_list_on_call","name":"List On Call Agents","isWebhook":false,"pointer":"/paths/~1v1~1ticketing~1escalation-policies~1{escalationPolicyId}~1on-call/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"List On Call Agents","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Returns a list of all on-call agents for an escalation policy."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ticketing_list_on_call"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"escalationPolicyId","in":"path","schemaId":"schema_13","required":true}],"pointer":"/paths/~1v1~1ticketing~1escalation-policies~1{escalationPolicyId}~1on-call/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1ticketing~1escalation-policies~1{escalationPolicyId}~1on-call/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/ticketing/escalation-policies/{escalationPolicyId}/on-call","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"escalationPolicyId","in":"path","required":true,"schemaId":"components/schemas/ApplicationId"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/ticketing/escalation-policies/{escalationPolicyId}/on-call","href":"ticketing/ticketing_list_on_call","openApiOperationId":"ticketing_list_on_call","summary":"List On Call Agents"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListOnCallResponse"}},"schemaId":"components/schemas/ListOnCallResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1ticketing~1escalation-policies~1{escalationPolicyId}~1on-call/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/ListOnCallResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/ListOnCallResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/ticketing/ticketing_list_on_call"}],"panels":[]}]},"httpPath":"/v1/ticketing/escalation-policies/{escalationPolicyId}/on-call"}],"content":{"contentType":"group","meta":{"name":"Ticketing"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Ticketing","showPageActions":true}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/ticketing/remote-fields","summary":"List Remote Fields","prefix":{"name":"get","color":"get"},"badges":[],"link":"/ticketing/ticketing_list_remote_fields","deprecated":false},{"title":"/v1/ticketing/issue-types/{projectId}","summary":"List Issue Types","prefix":{"name":"get","color":"get"},"badges":[],"link":"/ticketing/ticketing_list_issue_types","deprecated":false},{"title":"/v1/ticketing/remote-fields/{projectId}/{issueTypeId}","summary":"List Issue Type Remote Fields","prefix":{"name":"get","color":"get"},"badges":[],"link":"/ticketing/ticketing_list_issue_type_remote_fields","deprecated":false},{"title":"/v1/ticketing/projects","summary":"List Projects","prefix":{"name":"get","color":"get"},"badges":[],"link":"/ticketing/ticketing_list_projects","deprecated":false},{"title":"/v1/ticketing/tickets","summary":"Query Tickets","prefix":{"name":"get","color":"get"},"badges":[],"link":"/ticketing/ticketing_query_tickets","deprecated":false},{"title":"/v1/ticketing/tickets","summary":"Create Ticket","prefix":{"name":"post","color":"post"},"badges":[],"link":"/ticketing/ticketing_create_ticket","deprecated":false},{"title":"/v1/ticketing/tickets/{ticketId}","summary":"Get Ticket","prefix":{"name":"get","color":"get"},"badges":[],"link":"/ticketing/ticketing_get_ticket","deprecated":false},{"title":"/v1/ticketing/tickets/{ticketId}","summary":"Patch Ticket","prefix":{"name":"patch","color":"patch"},"badges":[],"link":"/ticketing/ticketing_patch_ticket","deprecated":false},{"title":"/v1/ticketing/attachments/{ticketId}","summary":"Create Attachment","prefix":{"name":"post","color":"post"},"badges":[],"link":"/ticketing/ticketing_create_attachment","deprecated":false},{"title":"/v1/ticketing/attachments/{ticketId}","summary":"List Attachments Metadata","prefix":{"name":"get","color":"get"},"badges":[],"link":"/ticketing/ticketing_list_attachments_metadata","deprecated":false},{"title":"/v1/ticketing/attachments/{ticketId}/{attachmentId}/download","summary":"Download Attachment","prefix":{"name":"get","color":"get"},"badges":[],"link":"/ticketing/ticketing_download_attachment","deprecated":false},{"title":"/v1/ticketing/attachments/{ticketId}/{attachmentId}","summary":"Delete Attachment","prefix":{"name":"delete","color":"delete"},"badges":[],"link":"/ticketing/ticketing_delete_attachment","deprecated":false},{"title":"/v1/ticketing/tickets/{ticketId}/comments","summary":"List Comments","prefix":{"name":"get","color":"get"},"badges":[],"link":"/ticketing/ticketing_list_comments","deprecated":false},{"title":"/v1/ticketing/tickets/{ticketId}/comments","summary":"Create Comment","prefix":{"name":"post","color":"post"},"badges":[],"link":"/ticketing/ticketing_create_comment","deprecated":false},{"title":"/v1/ticketing/tickets/{ticketId}/comments/{commentId}","summary":"Delete Comment","prefix":{"name":"delete","color":"delete"},"badges":[],"link":"/ticketing/ticketing_delete_comment","deprecated":false},{"title":"/v1/ticketing/tickets/{ticketId}/notes","summary":"Create Note","prefix":{"name":"post","color":"post"},"badges":[],"link":"/ticketing/ticketing_create_note","deprecated":false},{"title":"/v1/ticketing/tickets/{ticketId}/notes","summary":"List Notes","prefix":{"name":"get","color":"get"},"badges":[],"link":"/ticketing/ticketing_list_notes","deprecated":false},{"title":"/v1/ticketing/tickets/{ticketId}/notes/{noteId}","summary":"Delete Note","prefix":{"name":"delete","color":"delete"},"badges":[],"link":"/ticketing/ticketing_delete_note","deprecated":false},{"title":"/v1/ticketing/tickets/{ticketId}/notes/{noteId}","summary":"Patch Note","prefix":{"name":"patch","color":"patch"},"badges":[],"link":"/ticketing/ticketing_patch_note","deprecated":false},{"title":"/v1/ticketing/escalation-policies","summary":"Query Escalation Policies","prefix":{"name":"get","color":"get"},"badges":[],"link":"/ticketing/ticketing_query_escalation_policies","deprecated":false},{"title":"/v1/ticketing/escalation-policies/{escalationPolicyId}/on-call","summary":"List On Call Agents","prefix":{"name":"get","color":"get"},"badges":[],"link":"/ticketing/ticketing_list_on_call","deprecated":false}]}]}]}]}},{"type":"group","label":"Vulnerabilities","link":"/api-reference/connectors/vulnerabilities","routeSlug":"/api-reference/connectors/vulnerabilities","items":[{"label":"Query Findings","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/vulnerabilities/vulnerabilities_query_findings","routeSlug":"/api-reference/connectors/vulnerabilities/vulnerabilities_query_findings","metadata":{"seo":{"title":"Query Findings","description":"Query vulnerability findings"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"vulnerabilities_query_findings","name":"Query Findings","isWebhook":false,"pointer":"/paths/~1v1~1vulnerabilities~1findings/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Findings","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Query vulnerability findings"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"vulnerabilities_query_findings"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of finding reports to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/vulnerabilities/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1vulnerabilities~1findings/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/vulnerabilities/findings","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/vulnerabilities/findings","href":"vulnerabilities/vulnerabilities_query_findings","openApiOperationId":"vulnerabilities_query_findings","summary":"Query Findings"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryFindingsResponse"}},"schemaId":"components/schemas/QueryFindingsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1vulnerabilities~1findings/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryFindingsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryFindingsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/vulnerabilities/vulnerabilities_query_findings"}],"panels":[]}]},"httpPath":"/v1/vulnerabilities/findings"},{"label":"Create Findings","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/vulnerabilities/vulnerabilities_create_findings","routeSlug":"/api-reference/connectors/vulnerabilities/vulnerabilities_create_findings","metadata":{"seo":{"title":"Create Findings","description":"Create findings (bulk) in a vulnerability scanning system"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"vulnerabilities_create_findings","name":"Create Findings","isWebhook":false,"pointer":"/paths/~1v1~1vulnerabilities~1findings~1bulk/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Create Findings","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Create findings (bulk) in a vulnerability scanning system"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"vulnerabilities_create_findings"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1vulnerabilities~1findings~1bulk/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateFindingsRequest"}},"schemaId":"components/schemas/CreateFindingsRequest","pointer":"/paths/~1v1~1vulnerabilities~1findings~1bulk/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/vulnerabilities/findings/bulk","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/CreateFindingsRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/vulnerabilities/findings/bulk","href":"vulnerabilities/vulnerabilities_create_findings","openApiOperationId":"vulnerabilities_create_findings","summary":"Create Findings"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/CreateFindingsRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateFindingsRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateFindingsResponse"}},"schemaId":"components/schemas/CreateFindingsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1vulnerabilities~1findings~1bulk/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/CreateFindingsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateFindingsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/vulnerabilities/vulnerabilities_create_findings"}],"panels":[]}]},"httpPath":"/v1/vulnerabilities/findings/bulk"},{"label":"Update Finding","deprecated":false,"httpVerb":"put","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/vulnerabilities/vulnerabilities_update_finding","routeSlug":"/api-reference/connectors/vulnerabilities/vulnerabilities_update_finding","metadata":{"seo":{"title":"Update Finding","description":"update a finding in a vulnerability scanning system"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"vulnerabilities_update_finding","name":"Update Finding","isWebhook":false,"pointer":"/paths/~1v1~1vulnerabilities~1findings~1{findingId}/put","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Update Finding","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"update a finding in a vulnerability scanning system"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"vulnerabilities_update_finding"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"findingId","in":"path","schemaId":"schema_9","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Uid of the Finding (URL encoded). This will be "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding.uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in the OCSF model."},"children":[],"type":"text"}],"type":"paragraph"}],"required":true}],"pointer":"/paths/~1v1~1vulnerabilities~1findings~1{findingId}/put/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1vulnerabilities~1findings~1{findingId}/put/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/UpdateFindingRequest"}},"schemaId":"components/schemas/UpdateFindingRequest","pointer":"/paths/~1v1~1vulnerabilities~1findings~1{findingId}/put/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"PUT","path":"/v1/vulnerabilities/findings/{findingId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"findingId","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/UpdateFindingRequest"}},"responseCodes":["204","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/vulnerabilities/findings/{findingId}","href":"vulnerabilities/vulnerabilities_update_finding","openApiOperationId":"vulnerabilities_update_finding","summary":"Update Finding"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/UpdateFindingRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/UpdateFindingRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"204"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1vulnerabilities~1findings~1{findingId}/put/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"204"},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/vulnerabilities/vulnerabilities_update_finding"}],"panels":[]}]},"httpPath":"/v1/vulnerabilities/findings/{findingId}"},{"label":"Query Assets","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/vulnerabilities/vulnerabilities_query_assets","routeSlug":"/api-reference/connectors/vulnerabilities/vulnerabilities_query_assets","metadata":{"seo":{"title":"Query Assets","description":"Query assets in a vulnerability scanning system"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"vulnerabilities_query_assets","name":"Query Assets","isWebhook":false,"pointer":"/paths/~1v1~1vulnerabilities~1assets/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Assets","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Query assets in a vulnerability scanning system"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"vulnerabilities_query_assets"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of assets to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/vulnerabilities/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1vulnerabilities~1assets/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/vulnerabilities/assets","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/vulnerabilities/assets","href":"vulnerabilities/vulnerabilities_query_assets","openApiOperationId":"vulnerabilities_query_assets","summary":"Query Assets"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryAssetsResponse"}},"schemaId":"components/schemas/QueryAssetsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1vulnerabilities~1assets/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryAssetsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryAssetsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/vulnerabilities/vulnerabilities_query_assets"}],"panels":[]}]},"httpPath":"/v1/vulnerabilities/assets"},{"label":"Create Asset","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/vulnerabilities/vulnerabilities_create_asset","routeSlug":"/api-reference/connectors/vulnerabilities/vulnerabilities_create_asset","metadata":{"seo":{"title":"Create Asset","description":"Create assets in a vulnerability scanning system"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"vulnerabilities_create_asset","name":"Create Asset","isWebhook":false,"pointer":"/paths/~1v1~1vulnerabilities~1assets/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Create Asset","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Create assets in a vulnerability scanning system"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"vulnerabilities_create_asset"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1vulnerabilities~1assets/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateAssetRequest"}},"schemaId":"components/schemas/CreateAssetRequest","pointer":"/paths/~1v1~1vulnerabilities~1assets/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/vulnerabilities/assets","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/CreateAssetRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/vulnerabilities/assets","href":"vulnerabilities/vulnerabilities_create_asset","openApiOperationId":"vulnerabilities_create_asset","summary":"Create Asset"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/CreateAssetRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateAssetRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateAssetResponse"}},"schemaId":"components/schemas/CreateAssetResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1vulnerabilities~1assets/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/CreateAssetResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/CreateAssetResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/vulnerabilities/vulnerabilities_create_asset"}],"panels":[]}]},"httpPath":"/v1/vulnerabilities/assets"},{"label":"Update Asset","deprecated":false,"httpVerb":"put","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/vulnerabilities/vulnerabilities_update_asset","routeSlug":"/api-reference/connectors/vulnerabilities/vulnerabilities_update_asset","metadata":{"seo":{"title":"Update Asset","description":"update an asset in a vulnerability scanning system"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"vulnerabilities_update_asset","name":"Update Asset","isWebhook":false,"pointer":"/paths/~1v1~1vulnerabilities~1assets~1{assetId}/put","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Update Asset","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"update an asset in a vulnerability scanning system"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"vulnerabilities_update_asset"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"assetId","in":"path","schemaId":"schema_9","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Uid of the Asset. This will be "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"devices.uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in the OCSF model."},"children":[],"type":"text"}],"type":"paragraph"}],"required":true}],"pointer":"/paths/~1v1~1vulnerabilities~1assets~1{assetId}/put/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1vulnerabilities~1assets~1{assetId}/put/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateAssetRequest"}},"schemaId":"components/schemas/CreateAssetRequest","pointer":"/paths/~1v1~1vulnerabilities~1assets~1{assetId}/put/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"PUT","path":"/v1/vulnerabilities/assets/{assetId}","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"assetId","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/CreateAssetRequest"}},"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/vulnerabilities/assets/{assetId}","href":"vulnerabilities/vulnerabilities_update_asset","openApiOperationId":"vulnerabilities_update_asset","summary":"Update Asset"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/CreateAssetRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/CreateAssetRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"schema_48"}},"schemaId":"schema_48"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1vulnerabilities~1assets~1{assetId}/put/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"schema_48","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"schema_48"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/vulnerabilities/vulnerabilities_update_asset"}],"panels":[]}]},"httpPath":"/v1/vulnerabilities/assets/{assetId}"},{"label":"Query Scans","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/vulnerabilities/vulnerabilities_query_scans","routeSlug":"/api-reference/connectors/vulnerabilities/vulnerabilities_query_scans","metadata":{"seo":{"title":"Query Scans","description":"Query scans in a vulnerability scanning system"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"vulnerabilities_query_scans","name":"Query Scans","isWebhook":false,"pointer":"/paths/~1v1~1vulnerabilities~1scans/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Scans","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Query scans in a vulnerability scanning system"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"vulnerabilities_query_scans"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of scans to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/vulnerabilities/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1vulnerabilities~1scans/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/vulnerabilities/scans","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/vulnerabilities/scans","href":"vulnerabilities/vulnerabilities_query_scans","openApiOperationId":"vulnerabilities_query_scans","summary":"Query Scans"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryScansResponse"}},"schemaId":"components/schemas/QueryScansResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1vulnerabilities~1scans/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/QueryScansResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/QueryScansResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/vulnerabilities/vulnerabilities_query_scans"}],"panels":[]}]},"httpPath":"/v1/vulnerabilities/scans"},{"label":"Upload Scan","deprecated":false,"httpVerb":"post","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/vulnerabilities/vulnerabilities_upload_scan","routeSlug":"/api-reference/connectors/vulnerabilities/vulnerabilities_upload_scan","metadata":{"seo":{"title":"Upload Scan","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"vulnerabilities_upload_scan","name":"Upload Scan","isWebhook":false,"pointer":"/paths/~1v1~1vulnerabilities~1scans/post","hasSamples":true},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Upload Scan","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Upload a scan in a vulnerability scanning system"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"vulnerabilities_upload_scan"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1vulnerabilities~1scans/post/parameters"},{"nodeType":"item-content","variant":"body","label":"Request Body","labelTranslationKey":"body","required":true,"mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/UploadScanRequest"}},"schemaId":"components/schemas/UploadScanRequest","pointer":"/paths/~1v1~1vulnerabilities~1scans/post/requestBody"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"POST","path":"/v1/vulnerabilities/scans","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"requestBody":{"application/json":{"schemaId":"components/schemas/UploadScanRequest"}},"responseCodes":["200","400"],"pointer":"/v1/vulnerabilities/scans","href":"vulnerabilities/vulnerabilities_upload_scan","openApiOperationId":"vulnerabilities_upload_scan","summary":"Upload Scan"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"schemaId":"components/schemas/UploadScanRequest","mediaTypes":["application/json"],"mediaTypeSchemas":{"application/json":{"schemaId":"components/schemas/UploadScanRequest"}},"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/UploadScanResponse"}},"schemaId":"components/schemas/UploadScanResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1vulnerabilities~1scans/post/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/UploadScanResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/UploadScanResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/vulnerabilities/vulnerabilities_upload_scan"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/vulnerabilities/scans"},{"label":"Get Scan Activity","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/vulnerabilities/vulnerabilities_get_scan_activity","routeSlug":"/api-reference/connectors/vulnerabilities/vulnerabilities_get_scan_activity","metadata":{"seo":{"title":"Get Scan Activity","description":"Deprecated: use GET /scans/{scan_id}/activities instead, which returns the full execution history for a scan definition."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"vulnerabilities_get_scan_activity","name":"Get Scan Activity","isWebhook":false,"pointer":"/paths/~1v1~1vulnerabilities~1scans~1{scan_id}~1activity/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Scan Activity","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Deprecated: use GET /scans/{scan_id}/activities instead, which returns the full execution history for a scan definition."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"vulnerabilities_get_scan_activity"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"scan_id","in":"path","schemaId":"schema_9","description":"ID of the scan to get activity for (provider-specific; often scan definition or template id).","required":true}],"pointer":"/paths/~1v1~1vulnerabilities~1scans~1{scan_id}~1activity/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1vulnerabilities~1scans~1{scan_id}~1activity/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/vulnerabilities/scans/{scan_id}/activity","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"scan_id","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/vulnerabilities/scans/{scan_id}/activity","href":"vulnerabilities/vulnerabilities_get_scan_activity","openApiOperationId":"vulnerabilities_get_scan_activity","summary":"Get Scan Activity"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetScanActivityResponse"}},"schemaId":"components/schemas/GetScanActivityResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1vulnerabilities~1scans~1{scan_id}~1activity/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetScanActivityResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetScanActivityResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/vulnerabilities/vulnerabilities_get_scan_activity"}],"panels":[]}]},"httpPath":"/v1/vulnerabilities/scans/{scan_id}/activity"},{"label":"Get Scan Activities","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/vulnerabilities/vulnerabilities_get_scan_activities","routeSlug":"/api-reference/connectors/vulnerabilities/vulnerabilities_get_scan_activities","metadata":{"seo":{"title":"Get Scan Activities","description":"Get scan execution history for a configured scan. Returns one OCSF Scan Activity per execution (e.g. each Tenable.sc scan result for the given scan definition id)."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"vulnerabilities_get_scan_activities","name":"Get Scan Activities","isWebhook":false,"pointer":"/paths/~1v1~1vulnerabilities~1scans~1{scan_id}~1activities/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Scan Activities","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Get scan execution history for a configured scan. Returns one OCSF Scan Activity per execution (e.g. each Tenable.sc scan result for the given scan definition id)."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"vulnerabilities_get_scan_activities"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"scan_id","in":"path","schemaId":"schema_9","description":"ID of the scan definition whose execution history is requested.","required":true}],"pointer":"/paths/~1v1~1vulnerabilities~1scans~1{scan_id}~1activities/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1vulnerabilities~1scans~1{scan_id}~1activities/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/vulnerabilities/scans/{scan_id}/activities","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"scan_id","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/vulnerabilities/scans/{scan_id}/activities","href":"vulnerabilities/vulnerabilities_get_scan_activities","openApiOperationId":"vulnerabilities_get_scan_activities","summary":"Get Scan Activities"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetScanActivitiesResponse"}},"schemaId":"components/schemas/GetScanActivitiesResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1vulnerabilities~1scans~1{scan_id}~1activities/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetScanActivitiesResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetScanActivitiesResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/vulnerabilities/vulnerabilities_get_scan_activities"}],"panels":[]}]},"httpPath":"/v1/vulnerabilities/scans/{scan_id}/activities"},{"label":"Get Scan Status","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/vulnerabilities/vulnerabilities_get_scan_status","routeSlug":"/api-reference/connectors/vulnerabilities/vulnerabilities_get_scan_status","metadata":{"seo":{"title":"Get Scan Status","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"vulnerabilities_get_scan_status","name":"Get Scan Status","isWebhook":false,"pointer":"/paths/~1v1~1vulnerabilities~1scans~1{scan_id}~1status/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Scan Status","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Get the status of a upload scan"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"vulnerabilities_get_scan_status"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"scan_id","in":"path","schemaId":"schema_9","description":"ID of the scan to get the status of.","required":true}],"pointer":"/paths/~1v1~1vulnerabilities~1scans~1{scan_id}~1status/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1vulnerabilities~1scans~1{scan_id}~1status/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/vulnerabilities/scans/{scan_id}/status","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"scan_id","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/vulnerabilities/scans/{scan_id}/status","href":"vulnerabilities/vulnerabilities_get_scan_status","openApiOperationId":"vulnerabilities_get_scan_status","summary":"Get Scan Status"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetScanStatusResponse"}},"schemaId":"components/schemas/GetScanStatusResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1vulnerabilities~1scans~1{scan_id}~1status/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetScanStatusResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetScanStatusResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/vulnerabilities/vulnerabilities_get_scan_status"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/vulnerabilities/scans/{scan_id}/status"},{"label":"Get Labels","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/vulnerabilities/vulnerabilities_get_labels","routeSlug":"/api-reference/connectors/vulnerabilities/vulnerabilities_get_labels","metadata":{"seo":{"title":"Get Labels","description":"Get labels from an asset inventory system"}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"vulnerabilities_get_labels","name":"Get Labels","isWebhook":false,"pointer":"/paths/~1v1~1vulnerabilities~1labels/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Get Labels","isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Get labels from an asset inventory system"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"vulnerabilities_get_labels"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of labels to return. Defaults to 50."},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."}],"pointer":"/paths/~1v1~1vulnerabilities~1labels/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/vulnerabilities/labels","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400"],"pointer":"/v1/vulnerabilities/labels","href":"vulnerabilities/vulnerabilities_get_labels","openApiOperationId":"vulnerabilities_get_labels","summary":"Get Labels"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetLabelsResponse"}},"schemaId":"components/schemas/GetLabelsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1vulnerabilities~1labels/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/GetLabelsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/GetLabelsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/vulnerabilities/vulnerabilities_get_labels"}],"panels":[]}]},"httpPath":"/v1/vulnerabilities/labels"},{"label":"Query Scan Findings","deprecated":false,"httpVerb":"get","isAdditionalOperation":false,"isWebhook":false,"type":"link","link":"/api-reference/connectors/vulnerabilities/vulnerabilities_query_scan_findings","routeSlug":"/api-reference/connectors/vulnerabilities/vulnerabilities_query_scan_findings","metadata":{"seo":{"title":"Query Scan Findings","description":"This operation is actively being developed. Breaking changes should beexpected.Please contact us before using this operation."}},"content":{"contentType":"item","itemVariant":"httpItem","meta":{"sourceId":"vulnerabilities_query_scan_findings","name":"Query Scan Findings","isWebhook":false,"pointer":"/paths/~1v1~1vulnerabilities~1scans~1{scanId}~1findings/get","hasSamples":false},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Query Scan Findings","badges":[{"name":"Alpha","color":"in-development","position":"before"}],"isWebhook":false,"showPageActions":true}],"panels":[]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Request","labelTranslationKey":"request","deepLinkSuffix":"request"},{"nodeType":"markdoc","content":[{"$$mdtype":"Node","attributes":{"type":"warning","name":"In Development"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This operation is actively being developed. Breaking changes should be"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expected."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Please contact us before using this operation."},"children":[],"type":"text"}],"type":"paragraph"}],"type":"tag","tag":"admonition"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Query findings for a scan"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Operation ID:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"vulnerabilities_query_scan_findings"},"children":[],"type":"code"}],"type":"paragraph"}]},{"nodeType":"security","requirements":[{"schemes":[{"name":"BearerAuth","scopes":[],"type":"http","scheme":"bearer"}]}]},{"nodeType":"item-content","variant":"path","label":"Path","labelTranslationKey":"path","parameters":[{"name":"scanId","in":"path","schemaId":"schema_9","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ID of the scan to query findings for. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"query_scans"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" API to find available scan IDs."},"children":[],"type":"text"}],"type":"paragraph"}],"required":true}],"pointer":"/paths/~1v1~1vulnerabilities~1scans~1{scanId}~1findings/get/parameters"},{"nodeType":"item-content","variant":"query","label":"Query","labelTranslationKey":"query","parameters":[{"name":"meta","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Add metadata to the response by invoking meta functions. Documentation for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/api-reference/meta-functions"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"meta functions"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is available. Not all meta functions are available at every endpoint."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"limit","in":"query","schemaId":"schema_1","description":"Number of findings to return. Defaults to 50 with a maximum of 5000. If a provider has a maximum limit lower than 5000, the provider's maximum limit will be used instead."},{"name":"filter","in":"query","schemaId":"schema_0","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filter results by this query. For more information on filtering, refer to our "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"href":"https://docs.synqly.com/guides/connectors/vulnerabilities/query-filters"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Filtering Guide"},"children":[],"type":"text"}],"type":"link"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Defaults to no filter. If used more than once, the queries are ANDed together."},"children":[],"type":"text"}],"type":"paragraph"}]},{"name":"cursor","in":"query","schemaId":"schema_2","description":"Start search from cursor position."},{"name":"include_raw_data","in":"query","schemaId":"schema_3","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Include the raw data from the provider in the response. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}],"pointer":"/paths/~1v1~1vulnerabilities~1scans~1{scanId}~1findings/get/parameters"}],"panels":[{"children":[{"kind":"code-sample","source":{"kind":"code-sample","operationType":"http","method":"GET","path":"/v1/vulnerabilities/scans/{scanId}/findings","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"parameters":{"path":[{"name":"scanId","in":"path","required":true,"schemaId":"schema_9"}],"query":[{"name":"meta","in":"query","required":false,"schemaId":"schema_0"},{"name":"limit","in":"query","required":false,"schemaId":"schema_1"},{"name":"filter","in":"query","required":false,"schemaId":"schema_0"},{"name":"cursor","in":"query","required":false,"schemaId":"schema_2"},{"name":"include_raw_data","in":"query","required":false,"schemaId":"schema_3"}],"querystring":[],"header":[],"cookie":[]},"security":[{"schemes":[{"id":"BearerAuth","type":"http","scheme":"bearer"}],"scopes":[]}],"responseCodes":["200","400","401","402","403","404","405","409","415","429","500","501","502","503","504"],"pointer":"/v1/vulnerabilities/scans/{scanId}/findings","href":"vulnerabilities/vulnerabilities_query_scan_findings","openApiOperationId":"vulnerabilities_query_scan_findings","summary":"Query Scan Findings"},"isWebhook":false,"hideReplay":false,"servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"header","level":4,"label":"Responses","labelTranslationKey":"responses","deepLinkSuffix":"responses"},{"nodeType":"item-content","variant":"responses","responses":[{"code":"200","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/VulnerabilitiesQueryScanFindingsResponse"}},"schemaId":"components/schemas/VulnerabilitiesQueryScanFindingsResponse"},{"code":"400","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"401","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"402","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"403","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"404","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"405","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"409","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"415","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"429","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"500","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"501","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"502","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"503","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"},{"code":"504","mediaType":"application/json","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}},"schemaId":"components/schemas/Problem"}],"pointer":"/paths/~1v1~1vulnerabilities~1scans~1{scanId}~1findings/get/responses"}],"panels":[{"children":[{"kind":"response","responseCodes":[{"code":"200","schemaId":"components/schemas/VulnerabilitiesQueryScanFindingsResponse","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/VulnerabilitiesQueryScanFindingsResponse"}}},{"code":"400","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"401","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"402","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"403","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"404","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"405","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"409","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"415","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"429","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"500","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"501","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"502","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"503","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}},{"code":"504","schemaId":"components/schemas/Problem","mediaTypes":["application/json"],"mediaTypeContent":{"application/json":{"schemaId":"components/schemas/Problem"}}}],"examples":[]}]}]},{"nodeType":"container","children":[{"nodeType":"feedback","pageSlug":"/vulnerabilities/vulnerabilities_query_scan_findings"}],"panels":[]}]},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"httpPath":"/v1/vulnerabilities/scans/{scanId}/findings"}],"content":{"contentType":"group","meta":{"name":"Vulnerabilities"},"children":[{"nodeType":"container","children":[{"nodeType":"header","level":2,"label":"Vulnerabilities","showPageActions":true}],"panels":[{"children":[{"kind":"group-items","title":"Operations","titleTranslationKey":"operations","items":[{"title":"/v1/vulnerabilities/findings","summary":"Query Findings","prefix":{"name":"get","color":"get"},"badges":[],"link":"/vulnerabilities/vulnerabilities_query_findings","deprecated":false},{"title":"/v1/vulnerabilities/findings/bulk","summary":"Create Findings","prefix":{"name":"post","color":"post"},"badges":[],"link":"/vulnerabilities/vulnerabilities_create_findings","deprecated":false},{"title":"/v1/vulnerabilities/findings/{findingId}","summary":"Update Finding","prefix":{"name":"put","color":"put"},"badges":[],"link":"/vulnerabilities/vulnerabilities_update_finding","deprecated":false},{"title":"/v1/vulnerabilities/assets","summary":"Query Assets","prefix":{"name":"get","color":"get"},"badges":[],"link":"/vulnerabilities/vulnerabilities_query_assets","deprecated":false},{"title":"/v1/vulnerabilities/assets","summary":"Create Asset","prefix":{"name":"post","color":"post"},"badges":[],"link":"/vulnerabilities/vulnerabilities_create_asset","deprecated":false},{"title":"/v1/vulnerabilities/assets/{assetId}","summary":"Update Asset","prefix":{"name":"put","color":"put"},"badges":[],"link":"/vulnerabilities/vulnerabilities_update_asset","deprecated":false},{"title":"/v1/vulnerabilities/scans","summary":"Query Scans","prefix":{"name":"get","color":"get"},"badges":[],"link":"/vulnerabilities/vulnerabilities_query_scans","deprecated":false},{"title":"/v1/vulnerabilities/scans","summary":"Upload Scan","prefix":{"name":"post","color":"post"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/vulnerabilities/vulnerabilities_upload_scan","deprecated":false},{"title":"/v1/vulnerabilities/scans/{scan_id}/activity","summary":"Get Scan Activity","prefix":{"name":"get","color":"get"},"badges":[],"link":"/vulnerabilities/vulnerabilities_get_scan_activity","deprecated":false},{"title":"/v1/vulnerabilities/scans/{scan_id}/activities","summary":"Get Scan Activities","prefix":{"name":"get","color":"get"},"badges":[],"link":"/vulnerabilities/vulnerabilities_get_scan_activities","deprecated":false},{"title":"/v1/vulnerabilities/scans/{scan_id}/status","summary":"Get Scan Status","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/vulnerabilities/vulnerabilities_get_scan_status","deprecated":false},{"title":"/v1/vulnerabilities/labels","summary":"Get Labels","prefix":{"name":"get","color":"get"},"badges":[],"link":"/vulnerabilities/vulnerabilities_get_labels","deprecated":false},{"title":"/v1/vulnerabilities/scans/{scanId}/findings","summary":"Query Scan Findings","prefix":{"name":"get","color":"get"},"badges":[{"name":"Alpha","color":"in-development","position":"before"}],"link":"/vulnerabilities/vulnerabilities_query_scan_findings","deprecated":false}]}]}]}]}}],"store":{"schemaStore":{"components/schemas/UpdateAlertRequest":{"id":"components/schemas/UpdateAlertRequest","kind":"json-schema","title":"UpdateAlertRequest","data":{"title":"UpdateAlertRequest","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A partial update to one alert, in OCSF attributes. Absent fields are left unchanged. An empty request, a field this type does not define, and anything the provider cannot apply are rejected with a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", so a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2xx"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" means the whole request was applied. Each "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is a Problem: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"detail"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" says what was wrong, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"remediation"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" what to send instead, and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"context.parameter"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" names the field at fault."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingStatusId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The triage state to move the alert to, as an OCSF Detection Finding "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"status_id"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":":"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"0"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":": Unknown. Rejected with a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"item"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":": New."},"children":[],"type":"text"}],"type":"item"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":": InProgress."},"children":[],"type":"text"}],"type":"item"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":": Suppressed. Requires a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"verdict_id"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" other than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (TruePositive); either violation is rejected with a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"item"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"4"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":": Resolved."},"children":[],"type":"text"}],"type":"item"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"99"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":": Other. Rejected with a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"item"}],"type":"list"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Providers with no distinct suppressed state read a closed alert with a false-positive (or equivalent) verdict back as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"verdict_id":{"$ref":"#/components/schemas/ocsfv1.3.0incidentfindingVerdictId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The analyst verdict to record, as an OCSF Incident Finding "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"verdict_id"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":":"},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{"ordered":false,"marker":"-"},"children":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"0"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":": Unknown. Clears the verdict where the provider supports it."},"children":[],"type":"text"}],"type":"item"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":": FalsePositive."},"children":[],"type":"text"}],"type":"item"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":": TruePositive."},"children":[],"type":"text"}],"type":"item"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":": Disregard."},"children":[],"type":"text"}],"type":"item"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"4"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":": Suspicious."},"children":[],"type":"text"}],"type":"item"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"5"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":": Benign."},"children":[],"type":"text"}],"type":"item"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"6"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":": Test."},"children":[],"type":"text"}],"type":"item"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"7"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":": InsufficientData."},"children":[],"type":"text"}],"type":"item"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"8"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":": SecurityRisk."},"children":[],"type":"text"}],"type":"item"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"9"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":": ManagedExternally."},"children":[],"type":"text"}],"type":"item"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"10"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":": Duplicate."},"children":[],"type":"text"}],"type":"item"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"99"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":": Other. Rejected with a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"item"}],"type":"list"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Providers store different subsets, some only on a closed alert, and a verdict the provider cannot store is rejected with a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"comment":{"type":"string","nullable":true,"description":"A comment to append to the alert. Comments are appended, never replaced, so re-sending the same comment adds it twice."},"assignee":{"$ref":"#/components/schemas/AlertAssignee","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Who to assign the alert to, by exactly one of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"email_addr"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{}"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" unassigns where the provider supports it. Any other attribute, or an identifier sent as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"null"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", is rejected with a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"x-fern-availability":"in-development"}},"components/schemas/AlertAssignee":{"id":"components/schemas/AlertAssignee","kind":"json-schema","title":"AlertAssignee","data":{"title":"AlertAssignee","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The user an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"update_alert"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" request assigns an alert to. Set exactly one of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"email_addr"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or neither to unassign. A display name is not accepted: providers store one as a label without resolving it to a user, which would leave the alert unassigned while reporting success."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"uid":{"type":"string","nullable":true,"description":"The user's id in the provider."},"email_addr":{"type":"string","nullable":true,"description":"The user's email address, or user principal name where the provider uses one."}},"x-fern-availability":"in-development"}},"components/schemas/UpdateAlertResponse":{"id":"components/schemas/UpdateAlertResponse","kind":"json-schema","title":"UpdateAlertResponse","data":{"title":"UpdateAlertResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingDetectionFinding","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The updated alert, re-fetched from the provider after the write. Omitted when the write was applied but the alert could not be read back, for example because the re-fetch failed, was rate limited or did not find the alert. The response is still a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2xx"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in that case, and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"messages"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" carries a problem explaining why "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"result"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is missing. Every provider can omit it, so callers must not assume it is present."},"children":[],"type":"text"}],"type":"paragraph"}]}},"allOf":[{"$ref":"#/components/schemas/APIResponse"}],"x-fern-availability":"in-development"}},"components/schemas/ApplicationId":{"id":"components/schemas/ApplicationId","kind":"json-schema","title":"Id","data":{"title":"Id","type":"string"}},"components/schemas/FindingId":{"id":"components/schemas/FindingId","kind":"json-schema","title":"Id","data":{"title":"Id","type":"string"}},"components/schemas/AppSecApplication":{"id":"components/schemas/AppSecApplication","kind":"json-schema","title":"ocsflatestApplicationInventoryInfo","data":{"title":"ocsflatestApplicationInventoryInfo","$ref":"#/components/schemas/ocsfv1.8.0applicationinventoryinfoApplicationInventoryInfo"}},"components/schemas/AppSecPostureFinding":{"id":"components/schemas/AppSecPostureFinding","kind":"json-schema","title":"ocsflatestApplicationSecurityPostureFinding","data":{"title":"ocsflatestApplicationSecurityPostureFinding","$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingApplicationSecurityPostureFinding"}},"components/schemas/AppSecCreateFindingsResponse":{"id":"components/schemas/AppSecCreateFindingsResponse","kind":"json-schema","title":"AppSecCreateFindingsResponse","data":{"title":"AppSecCreateFindingsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/AppSecPostureFinding"},"description":"Created findings when the provider returns them synchronously. ServiceNow AVR import does not return created OCSF rows, so this is an empty list in that case. Review messages for per-row failure details."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}],"x-fern-availability":"in-development"}},"components/schemas/AppSecQueryFindingsResponse":{"id":"components/schemas/AppSecQueryFindingsResponse","kind":"json-schema","title":"AppSecQueryFindingsResponse","data":{"title":"AppSecQueryFindingsResponse","type":"object","description":"The combined result of an application's finding and the application details from the token-linked application security integration.","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/AppSecPostureFinding"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"pre-release"}},"components/schemas/AppSecQueryApplicationsResponse":{"id":"components/schemas/AppSecQueryApplicationsResponse","kind":"json-schema","title":"AppSecQueryApplicationsResponse","data":{"title":"AppSecQueryApplicationsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/AppSecApplication"},"description":"List of applications"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"pre-release"}},"components/schemas/AppSecQueryApplicationFindingsResponse":{"id":"components/schemas/AppSecQueryApplicationFindingsResponse","kind":"json-schema","title":"AppSecQueryApplicationFindingsResponse","data":{"title":"AppSecQueryApplicationFindingsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/AppSecPostureFinding"},"description":"List of application findings"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"pre-release"}},"components/schemas/AppSecGetApplicationFindingDetailsResponse":{"id":"components/schemas/AppSecGetApplicationFindingDetailsResponse","kind":"json-schema","title":"AppSecGetApplicationFindingDetailsResponse","data":{"title":"AppSecGetApplicationFindingDetailsResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/AppSecPostureFinding","description":"Details of an application's finding"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"pre-release"}},"components/schemas/AppSecScanActivity":{"id":"components/schemas/AppSecScanActivity","kind":"json-schema","title":"ocsflatestScanActivity","data":{"title":"ocsflatestScanActivity","$ref":"#/components/schemas/ocsfv1.8.0scanactivityScanActivity"}},"components/schemas/AppSecQueryApplicationScansResponse":{"id":"components/schemas/AppSecQueryApplicationScansResponse","kind":"json-schema","title":"AppSecQueryApplicationScansResponse","data":{"title":"AppSecQueryApplicationScansResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/AppSecScanActivity"},"description":"List of scan activity records for the application."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"in-development"}},"components/schemas/Device":{"id":"components/schemas/Device","kind":"json-schema","title":"ocsfv1.3.0inventoryinfoInventoryInfo","data":{"title":"ocsfv1.3.0inventoryinfoInventoryInfo","type":"object","description":"Device Inventory Info events report device inventory data that is either logged or proactively collected. For example, when collecting device information from a CMDB or running a network sweep of connected devices.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","description":"The device that is being discovered by an inventory process."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","device","metadata","severity_id","time","type_uid"]}},"components/schemas/QueryDevicesResponse":{"id":"components/schemas/QueryDevicesResponse","kind":"json-schema","title":"QueryDevicesResponse","data":{"title":"QueryDevicesResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/Device"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/CreateDeviceRequest":{"id":"components/schemas/CreateDeviceRequest","kind":"json-schema","title":"CreateDeviceRequest","data":{"title":"CreateDeviceRequest","type":"object","properties":{"device":{"$ref":"#/components/schemas/Device"},"source_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Optional connector hint (for example ServiceNow discovery_source with Identify & Reconcile)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Omit or leave empty when the integration does not use it; some integrations require it."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["device"]}},"components/schemas/CreateDeviceResponse":{"id":"components/schemas/CreateDeviceResponse","kind":"json-schema","title":"CreateDeviceResponse","data":{"title":"CreateDeviceResponse","type":"object","properties":{"device":{"$ref":"#/components/schemas/Device"}},"required":["device"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/CreateDevicesRequest":{"id":"components/schemas/CreateDevicesRequest","kind":"json-schema","title":"CreateDevicesRequest","data":{"title":"CreateDevicesRequest","type":"object","properties":{"devices":{"type":"array","items":{"$ref":"#/components/schemas/Device"}},"custom_properties":{"type":"object","additionalProperties":{"type":"string"},"nullable":true},"source_name":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Connector hint passed to the integration (for example ServiceNow discovery_source with Identify & Reconcile)."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["devices","source_name"]}},"components/schemas/CreateDevicesResponse":{"id":"components/schemas/CreateDevicesResponse","kind":"json-schema","title":"CreateDevicesResponse","data":{"title":"CreateDevicesResponse","type":"object","properties":{"status":{"$ref":"#/components/schemas/QueryStatus","description":"Specifies the status of the bulk create devices job, which can be COMPLETE or PENDING."},"errors":{"$ref":"#/components/schemas/Problem","nullable":true,"description":"Provides additional details about any errors encountered during the bulk create operation."}},"required":["status"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/GetLabelsResponse":{"id":"components/schemas/GetLabelsResponse","kind":"json-schema","title":"GetLabelsResponse","data":{"title":"GetLabelsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/Label"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/Label":{"id":"components/schemas/Label","kind":"json-schema","title":"Label","data":{"title":"Label","type":"object","properties":{"key":{"type":"string","nullable":true},"value":{"type":"string"}},"required":["value"]}},"components/schemas/SoftwareInventory":{"id":"components/schemas/SoftwareInventory","kind":"json-schema","title":"ocsfv1.8.0softwareinventoryinfoSoftwareInfo","data":{"title":"ocsfv1.8.0softwareinventoryinfoSoftwareInfo","type":"object","description":"Software Inventory Info events report device software inventory data that is either logged or proactively collected. For example, when collecting device information from a CMDB or running a network sweep of connected devices.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.8.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"device":{"$ref":"#/components/schemas/ocsfv1.8.0Device","description":"The device that is being discovered by an inventory process."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"package":{"$ref":"#/components/schemas/ocsfv1.8.0Package","nullable":true,"description":"The device software that is being discovered by an inventory process."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"product":{"$ref":"#/components/schemas/ocsfv1.8.0Product","nullable":true,"description":"Additional product attributes that have been discovered or enriched from a catalog or other external source."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"sbom":{"$ref":"#/components/schemas/ocsfv1.8.0Sbom","nullable":true,"description":"The Software Bill of Materials (SBOM) of the device software that is being discovered by an inventory process."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","device","metadata","severity_id","time","type_uid"]}},"components/schemas/QuerySoftwareInventoryResponse":{"id":"components/schemas/QuerySoftwareInventoryResponse","kind":"json-schema","title":"QuerySoftwareInventoryResponse","data":{"title":"QuerySoftwareInventoryResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/SoftwareInventory"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/CreateSoftwareInventoryRequest":{"id":"components/schemas/CreateSoftwareInventoryRequest","kind":"json-schema","title":"CreateSoftwareInventoryRequest","data":{"title":"CreateSoftwareInventoryRequest","type":"object","properties":{"software_inventory":{"$ref":"#/components/schemas/SoftwareInventory"},"source_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Optional connector hint (for example ServiceNow discovery_source with Identify & Reconcile)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Omit or leave empty when the integration does not use it; some integrations require it."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Tenable Cloud:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"source_name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is required. It scopes how imported software is merged"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"on the asset; reuse the same value across syncs for a given data source. Software from"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"other sources is not replaced or removed when you import under a different "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"source_name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["software_inventory"]}},"components/schemas/CreateSoftwareInventoryResponse":{"id":"components/schemas/CreateSoftwareInventoryResponse","kind":"json-schema","title":"CreateSoftwareInventoryResponse","data":{"title":"CreateSoftwareInventoryResponse","type":"object","properties":{"software_inventory":{"$ref":"#/components/schemas/SoftwareInventory"}},"required":["software_inventory"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/UpdateSoftwareInventoryRequest":{"id":"components/schemas/UpdateSoftwareInventoryRequest","kind":"json-schema","title":"UpdateSoftwareInventoryRequest","data":{"title":"UpdateSoftwareInventoryRequest","type":"object","properties":{"software_inventory":{"$ref":"#/components/schemas/SoftwareInventory"},"source_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Optional connector hint (for example ServiceNow discovery_source with Identify & Reconcile)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Omit or leave empty when the integration does not use it; some integrations require it."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"marker":"**"},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Tenable Cloud:"},"children":[],"type":"text"}],"type":"strong"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"source_name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is required. It scopes how imported software is merged"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"on the asset; reuse the same value across syncs for a given data source. Software from"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"other sources is not replaced or removed when you import under a different "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"source_name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["software_inventory"]}},"components/schemas/UpdateSoftwareInventoryResponse":{"id":"components/schemas/UpdateSoftwareInventoryResponse","kind":"json-schema","title":"UpdateSoftwareInventoryResponse","data":{"title":"UpdateSoftwareInventoryResponse","type":"object","properties":{"software_inventory":{"$ref":"#/components/schemas/SoftwareInventory"}},"required":["software_inventory"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/ChatQueryUsersResponse":{"id":"components/schemas/ChatQueryUsersResponse","kind":"json-schema","title":"ChatQueryUsersResponse","data":{"title":"ChatQueryUsersResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsflatestEntityManagement"},"description":"List of users, each wrapped in an OCSF Entity Management event of type Read."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/ChatQueryConversationsResponse":{"id":"components/schemas/ChatQueryConversationsResponse","kind":"json-schema","title":"ChatQueryConversationsResponse","data":{"title":"ChatQueryConversationsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0conversationactivityConversationActivity"},"description":"List of conversations, each wrapped in an OCSF Conversation Activity event of type List."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/ChatQueryConversationMembersResponse":{"id":"components/schemas/ChatQueryConversationMembersResponse","kind":"json-schema","title":"ChatQueryConversationMembersResponse","data":{"title":"ChatQueryConversationMembersResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsflatestEntityManagement"},"description":"List of conversation members, each wrapped in an OCSF Entity Management event of type Read."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/ChatQueryMessagesResponse":{"id":"components/schemas/ChatQueryMessagesResponse","kind":"json-schema","title":"ChatQueryMessagesResponse","data":{"title":"ChatQueryMessagesResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0chatmessageactivityChatMessageActivity"},"description":"List of messages, each wrapped in an OCSF Chat Message Activity event."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/ChatMessageResponse":{"id":"components/schemas/ChatMessageResponse","kind":"json-schema","title":"ChatMessageResponse","data":{"title":"ChatMessageResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/ocsfv1.8.0chatmessageactivityChatMessageActivity","description":"The message that was written."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}],"x-fern-availability":"in-development"}},"components/schemas/QueryComplianceFindingsResponse":{"id":"components/schemas/QueryComplianceFindingsResponse","kind":"json-schema","title":"QueryComplianceFindingsResponse","data":{"title":"QueryComplianceFindingsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsflatestComplianceFinding"},"description":"List of compliance findings that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/QueryCloudResourceInventoryResponse":{"id":"components/schemas/QueryCloudResourceInventoryResponse","kind":"json-schema","title":"QueryCloudResourceInventoryResponse","data":{"title":"QueryCloudResourceInventoryResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsflatestCloudResourcesInventoryInfo"},"description":"List of cloud resources that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/QueryIomsResponse":{"id":"components/schemas/QueryIomsResponse","kind":"json-schema","title":"QueryIomsResponse","data":{"title":"QueryIomsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsflatestComplianceFinding"},"description":"List of IOM findings that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/QueryEventsResponse":{"id":"components/schemas/QueryEventsResponse","kind":"json-schema","title":"QueryEventsResponse","data":{"title":"QueryEventsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/Event"},"description":"List of events that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/QueryCloudSecurityThreatsResponse":{"id":"components/schemas/QueryCloudSecurityThreatsResponse","kind":"json-schema","title":"QueryCloudSecurityThreatsResponse","data":{"title":"QueryCloudSecurityThreatsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsflatestDetectionFinding"},"description":"List of cloud security threats that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/Id":{"id":"components/schemas/Id","kind":"json-schema","title":"Id","data":{"title":"Id","type":"string"}},"components/schemas/Base":{"id":"components/schemas/Base","kind":"json-schema","title":"Base","data":{"title":"Base","type":"object","properties":{"name":{"type":"string","description":"Human-readable name for this resource"},"created_at":{"type":"string","format":"date-time","description":"Time object was originally created"},"updated_at":{"type":"string","format":"date-time","description":"Last time object was updated"}},"required":["name","created_at","updated_at"]}},"components/schemas/UserReference":{"id":"components/schemas/UserReference","kind":"json-schema","title":"UserReference","data":{"title":"UserReference","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A user in the provider, identified by exactly one of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"email_addr"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Setting both or neither is rejected with a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"uid":{"type":"string","nullable":true,"description":"The user's id in the provider."},"email_addr":{"type":"string","nullable":true,"description":"The user's email address, or user principal name where the provider uses one."}},"x-fern-availability":"in-development"}},"components/schemas/Problem":{"id":"components/schemas/Problem","kind":"json-schema","title":"Problem","data":{"title":"Problem","type":"object","description":"Generic base type for problems in Synqly. This object carries both machine-readable data as well as information intended for display purposes.","properties":{"type":{"$ref":"#/components/schemas/ProblemType","nullable":true},"occurred_at":{"type":"string","format":"date-time","description":"The date and time the problem occurred."},"status":{"type":"integer","description":"The HTTP status code of the problem. Matches the HTTP response code sent by the server."},"instance":{"type":"string","description":"A URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced."},"cause":{"type":"array","items":{"$ref":"#/components/schemas/ProblemCause"},"nullable":true,"description":"A list of the root cause(s) for this problem occurrence. Includes at minimum one root cause, and is otherwise an unordered list of causes."}},"required":["occurred_at","status","instance"],"allOf":[{"$ref":"#/components/schemas/ProblemDetails"}]}},"components/schemas/ProblemCause":{"id":"components/schemas/ProblemCause","kind":"json-schema","title":"ProblemCause","data":{"title":"ProblemCause","type":"object","properties":{"type":{"$ref":"#/components/schemas/ProblemType"}},"required":["type"],"allOf":[{"$ref":"#/components/schemas/ProblemDetails"}]}},"components/schemas/ProblemType":{"id":"components/schemas/ProblemType","kind":"json-schema","title":"ProblemType","data":{"title":"ProblemType","type":"string","description":"A URI reference that identifies the type of problem that occurred. When the URI scheme is HTTP(s), it may or may not be possible to deference the URL to a display-friendly description of the problem type."}},"components/schemas/ProblemDetails":{"id":"components/schemas/ProblemDetails","kind":"json-schema","title":"ProblemDetails","data":{"title":"ProblemDetails","type":"object","properties":{"message":{"type":"string","description":"A short, display-friendly summary of the problem."},"detail":{"type":"string","nullable":true,"description":"A display-friendly and more detailed explanation of the problem. It may offer additional contextual detail, but may also be just a generic description of the problem."},"remediation":{"type":"string","nullable":true,"description":"A display-friendly explanation for how to remediate the problem. This field may be omitted in case there are multiple problems, each with its own remediation, or if no remediation is possible."},"context":{"$ref":"#/components/schemas/ProblemContext","nullable":true,"description":"Additional context providing further detail about the problem, such as a problematic input parameter and/or a list of related resources."}},"required":["message"]}},"components/schemas/ProblemContext":{"id":"components/schemas/ProblemContext","kind":"json-schema","title":"ProblemContext","data":{"title":"ProblemContext","type":"object","properties":{"parameter":{"$ref":"#/components/schemas/ProblematicParameter","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the problem is related to a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"query"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"header"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"path"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"body"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" parameter, this field will describe the problematic parameter and where to find it."},"children":[],"type":"text"}],"type":"paragraph"}]},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ResourceReference"},"nullable":true},"raw_error":{"type":"string","nullable":true,"description":"If available this represents the underlying raw error, for example an error response from a Provider."},"provider_details":{"type":"object","additionalProperties":{"type":"string"},"nullable":true,"description":"If available this represents the underlying details from the provider. May include the error message, status code, and other details."}}}},"components/schemas/ProblematicParameter":{"id":"components/schemas/ProblematicParameter","kind":"json-schema","title":"ProblematicParameter","data":{"title":"ProblematicParameter","type":"object","properties":{"id":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"location"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the parameter is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"body"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", this value is always a JSON Pointer, otherwise it's the name of the parameter."},"children":[],"type":"text"}],"type":"paragraph"}]},"location":{"$ref":"#/components/schemas/ParameterLocation","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The location of the parameter. Possible values are "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"query"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"header"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"path"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"body"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"value":{"nullable":true,"description":"The given value of the parameter."}},"required":["id","location"]}},"components/schemas/ParameterLocation":{"id":"components/schemas/ParameterLocation","kind":"json-schema","title":"ParameterLocation","data":{"title":"ParameterLocation","type":"string","enum":["header","path","query","body"]}},"components/schemas/ResourceReference":{"id":"components/schemas/ResourceReference","kind":"json-schema","title":"ResourceReference","data":{"title":"ResourceReference","type":"object","properties":{"type":{"$ref":"#/components/schemas/ResourceType","description":"Type of the related resource."},"id":{"type":"string","description":"ID of the related resource."},"rel":{"$ref":"#/components/schemas/ProblemRelation","description":"The way in which the resource relates to the problem."}},"required":["type","id","rel"]}},"components/schemas/ProblemRelation":{"id":"components/schemas/ProblemRelation","kind":"json-schema","title":"ProblemRelation","data":{"title":"ProblemRelation","type":"string","enum":["affected","cause"]}},"components/schemas/ResourceType":{"id":"components/schemas/ResourceType","kind":"json-schema","title":"ResourceType","data":{"title":"ResourceType","type":"string","enum":["account","bridge","credential","integration_point","integration","member","operation","organization_webhook","role","sub_org","token","transform"]}},"components/schemas/PatchOp":{"id":"components/schemas/PatchOp","kind":"json-schema","title":"PatchOp","data":{"title":"PatchOp","type":"string","enum":["add","copy","move","remove","replace","test"]}},"components/schemas/PatchOperation":{"id":"components/schemas/PatchOperation","kind":"json-schema","title":"PatchOperation","data":{"title":"PatchOperation","type":"object","description":"JSON patch to apply. A JSON patch is a list of patch operations. (see https://jsonpatch.com/)","properties":{"op":{"$ref":"#/components/schemas/PatchOp","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The operation to perform. Supported values are "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"add"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"copy"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"move"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"replace"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"remove"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"test"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"path":{"type":"string","description":"The path to the field to update. The path is a JSON Pointer."},"from":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The path to the field to copy from. This is required for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"copy"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"move"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" operations."},"children":[],"type":"text"}],"type":"paragraph"}]},"value":{"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The value to set the field to. This is required for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"add"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"replace"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"test"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" operations."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["op","path"]}},"components/schemas/Application":{"id":"components/schemas/Application","kind":"json-schema","title":"ocsfv1.3.0softwareinfoSoftwareInfo","data":{"title":"ocsfv1.3.0softwareinfoSoftwareInfo","type":"object","description":"Device Software Info events report device software data that is either logged or proactively collected.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0softwareinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0softwareinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0softwareinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"The device that the software is loaded on."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"product":{"$ref":"#/components/schemas/ocsfv1.3.0Product","description":"The software product that is being discovered."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0softwareinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0softwareinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0softwareinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","product","severity_id","time","type_uid"]}},"components/schemas/ThreatEvent":{"id":"components/schemas/ThreatEvent","kind":"json-schema","title":"ocsfv1.3.0detectionfindingDetectionFinding","data":{"title":"ocsfv1.3.0detectionfindingDetectionFinding","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the product is a security control, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile should be applied and its "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"attacks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" information should be duplicated into the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. Dispositions conform to an action of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed' or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Denied' in most cases. Note that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"99"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Other' is not an option. No action would equate to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingActivityId","description":"The normalized identifier of the finding activity."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The finding activity name, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects describing the tactics, techniques & sub-techniques identified by a security control or finding."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"comment":{"type":"string","nullable":true,"description":"A user provided comment about the finding."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the affected device/host. It can be used in conjunction with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Affected Resource(s)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. Specific details about an AWS EC2 instance, that is affected by the Finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time of the most recent event included in the finding."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the most recent event included in the finding."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"evidences":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Evidences"},"nullable":true,"description":"Describes various evidence artifacts associated to the activity/activities that triggered a security detection."},"finding_info":{"$ref":"#/components/schemas/ocsfv1.3.0FindingInfo","description":"Describes the supporting information about a generated finding."},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.3.0FirewallRule","nullable":true,"description":"The firewall rule that triggered the event."},"impact":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"impact_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingImpactId","nullable":true,"description":"The normalized impact of the finding."},"impact_score":{"type":"integer","nullable":true,"description":"The impact of the finding, valid range 0-100."},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"remediation":{"$ref":"#/components/schemas/ocsfv1.3.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0ResourceDetails"},"nullable":true,"description":"Describes details about resources that were the target of the activity that triggered the finding."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time of the least recent event included in the finding."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the least recent event included in the finding."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingStatusId","nullable":true,"description":"The normalized status identifier of the Finding, set by the consumer."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"vulnerabilities":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Vulnerability"},"nullable":true,"description":"Describes vulnerabilities reported in a Detection Finding."}},"required":["activity_id","category_uid","class_uid","finding_info","metadata","severity_id","time","type_uid"]}},"components/schemas/PostureScore":{"id":"components/schemas/PostureScore","kind":"json-schema","title":"ocsfv1.3.0configstateConfigState","data":{"title":"ocsfv1.3.0configstateConfigState","type":"object","description":"Device Config State events report device configuration data and CIS Benchmark results.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0configstateActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0configstateCategoryUid","description":"The category unique identifier of the event."},"cis_benchmark_result":{"$ref":"#/components/schemas/ocsfv1.3.0CisBenchmarkResult","nullable":true,"description":"The CIS benchmark result."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0configstateClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","description":"The device that is being discovered by an inventory process."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0configstateSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0configstateStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0configstateTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","device","metadata","severity_id","time","type_uid"]}},"components/schemas/ConnectionState":{"id":"components/schemas/ConnectionState","kind":"json-schema","title":"ConnectionState","data":{"title":"ConnectionState","type":"string","enum":["Connect","Disconnect"]}},"components/schemas/IsolationType":{"id":"components/schemas/IsolationType","kind":"json-schema","title":"IsolationType","data":{"title":"IsolationType","type":"string","enum":["Full","Selective"]}},"components/schemas/NetworkQuarantineRequest":{"id":"components/schemas/NetworkQuarantineRequest","kind":"json-schema","title":"NetworkQuarantineRequest","data":{"title":"NetworkQuarantineRequest","type":"object","properties":{"state":{"$ref":"#/components/schemas/ConnectionState","description":"The connection state (Connect or Disconnect) to enforce for the provided endpoint IDs."},"endpoint_ids":{"type":"array","items":{"type":"string"},"description":"The list of endpoint IDs to enforce the connection state on."},"comment":{"type":"string","nullable":true,"description":"A comment to include with the quarantine action."},"isolation_type":{"$ref":"#/components/schemas/IsolationType","nullable":true,"description":"The isolation type for the quarantine action. Defaults to Full. Currently only Microsoft Defender honors Selective; other providers always perform full isolation and ignore this field."}},"required":["state","endpoint_ids"]}},"components/schemas/NetworkQuarantineResponse":{"id":"components/schemas/NetworkQuarantineResponse","kind":"json-schema","title":"NetworkQuarantineResponse","data":{"title":"NetworkQuarantineResponse","type":"object","properties":{"result":{"type":"array","items":{"type":"string"},"description":"The list of endpoint IDs or action IDs that were successfully quarantined or unquarantined."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/ExecuteCommandRequest":{"id":"components/schemas/ExecuteCommandRequest","kind":"json-schema","title":"ExecuteCommandRequest","data":{"title":"ExecuteCommandRequest","type":"object","properties":{"command":{"type":"string","description":"The command string to execute on the remote endpoint."},"cursor":{"type":"string","nullable":true,"description":"Opaque cursor returned from a previous pending response, used to continue polling the in-flight provider command."}},"required":["command"]}},"components/schemas/ExecuteCommandResult":{"id":"components/schemas/ExecuteCommandResult","kind":"json-schema","title":"ExecuteCommandResult","data":{"title":"ExecuteCommandResult","type":"object","properties":{"device_uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The OCSF "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"device.uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the endpoint the command ran on."},"children":[],"type":"text"}],"type":"paragraph"}]},"command":{"type":"string","description":"The normalized command string that Synqly executed."},"stdout":{"type":"string","nullable":true,"description":"The command stdout collected during the synchronous polling window."},"stderr":{"type":"string","nullable":true,"description":"The command stderr collected during the synchronous polling window."}},"required":["device_uid","command"]}},"components/schemas/ExecuteCommandResponse":{"id":"components/schemas/ExecuteCommandResponse","kind":"json-schema","title":"ExecuteCommandResponse","data":{"title":"ExecuteCommandResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/ExecuteCommandResult","nullable":true,"description":"The normalized command result. This may be omitted while the command is still pending and no output is yet available."}},"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"},{"$ref":"#/components/schemas/APIHasStatus"}]}},"components/schemas/ExecuteRemoteScriptRequest":{"id":"components/schemas/ExecuteRemoteScriptRequest","kind":"json-schema","title":"ExecuteRemoteScriptRequest","data":{"title":"ExecuteRemoteScriptRequest","type":"object","properties":{"script":{"type":"string","description":"The script content to run on the remote endpoint. Required to start an execution. When resuming with a cursor it may be left empty; if sent, it must match the original."},"args":{"type":"string","nullable":true,"description":"Optional command-line arguments passed to the script. Providers may limit their length and the characters they accept."},"cursor":{"type":"string","nullable":true,"description":"Opaque cursor returned from a previous pending response, used to continue polling the in-flight execution. A resume needs only the cursor: the script may be left empty and args omitted. However, any that are sent on a resume  must match the original execution. An execution left pending and never  resumed may leave provider objects behind."}},"required":["script"]}},"components/schemas/ExecuteRemoteScriptResult":{"id":"components/schemas/ExecuteRemoteScriptResult","kind":"json-schema","title":"ExecuteRemoteScriptResult","data":{"title":"ExecuteRemoteScriptResult","type":"object","properties":{"device_uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The OCSF "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"device.uid"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the endpoint the script ran on."},"children":[],"type":"text"}],"type":"paragraph"}]},"stdout":{"type":"string","nullable":true,"description":"The script stdout collected during the synchronous polling window."},"stderr":{"type":"string","nullable":true,"description":"The script stderr collected during the synchronous polling window. Omitted by providers that merge stderr into stdout."}},"required":["device_uid"]}},"components/schemas/ExecuteRemoteScriptResponse":{"id":"components/schemas/ExecuteRemoteScriptResponse","kind":"json-schema","title":"ExecuteRemoteScriptResponse","data":{"title":"ExecuteRemoteScriptResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/ExecuteRemoteScriptResult","nullable":true,"description":"The normalized script result. This may be omitted while the execution is still pending and no output is yet available."}},"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"},{"$ref":"#/components/schemas/APIHasStatus"}]}},"components/schemas/RetrieveFileRequest":{"id":"components/schemas/RetrieveFileRequest","kind":"json-schema","title":"RetrieveFileRequest","data":{"title":"RetrieveFileRequest","type":"object","properties":{"path":{"type":"string","description":"The remote file path to retrieve from the endpoint."},"password":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Password used to protect the returned file archive. Required by providers that encrypt the retrieved archive (e.g. SentinelOne, which requires 10+ characters with mixed case, a digit, and a symbol); ignored by providers that do not (e.g. CrowdStrike)."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["path"]}},"components/schemas/QueryEndpointsResponse":{"id":"components/schemas/QueryEndpointsResponse","kind":"json-schema","title":"QueryEndpointsResponse","data":{"title":"QueryEndpointsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/Device"},"description":"List of endpoint assets that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/QueryApplicationsResponse":{"id":"components/schemas/QueryApplicationsResponse","kind":"json-schema","title":"QueryApplicationsResponse","data":{"title":"QueryApplicationsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/Application"},"description":"List of applications that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/QueryThreatsResponse":{"id":"components/schemas/QueryThreatsResponse","kind":"json-schema","title":"QueryThreatsResponse","data":{"title":"QueryThreatsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ThreatEvent"},"description":"List of threats that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/QueryAlertsResponse":{"id":"components/schemas/QueryAlertsResponse","kind":"json-schema","title":"QueryAlertsResponse","data":{"title":"QueryAlertsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/Event"},"description":"List of alerts that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/QueryIocsResponse":{"id":"components/schemas/QueryIocsResponse","kind":"json-schema","title":"QueryIocsResponse","data":{"title":"QueryIocsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/stixIndicator"},"description":"List of iocs that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/CreateIocsRequest":{"id":"components/schemas/CreateIocsRequest","kind":"json-schema","title":"CreateIocsRequest","data":{"title":"CreateIocsRequest","type":"object","properties":{"indicators":{"type":"array","items":{"$ref":"#/components/schemas/stixIndicator"},"description":"The list of iocs to create"}},"required":["indicators"]}},"components/schemas/CreateIocsResponse":{"id":"components/schemas/CreateIocsResponse","kind":"json-schema","title":"CreateIocsResponse","data":{"title":"CreateIocsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/stixIndicator"},"description":"A list of the indicators that were created"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/DeleteIocsResponse":{"id":"components/schemas/DeleteIocsResponse","kind":"json-schema","title":"DeleteIocsResponse","data":{"title":"DeleteIocsResponse","type":"object","properties":{"result":{"type":"array","items":{"type":"string"},"description":"A list of ids of the iocs that were deleted."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/IoaPlatform":{"id":"components/schemas/IoaPlatform","kind":"json-schema","title":"IoaPlatform","data":{"title":"IoaPlatform","type":"string","enum":["windows","mac","linux"],"description":"The operating system platform an IOA rule applies to."}},"components/schemas/IoaRuleType":{"id":"components/schemas/IoaRuleType","kind":"json-schema","title":"IoaRuleType","data":{"title":"IoaRuleType","type":"string","enum":["process_creation","file_creation","network_connection","domain_name"],"description":"The kind of endpoint activity an IOA rule matches on."}},"components/schemas/IoaAction":{"id":"components/schemas/IoaAction","kind":"json-schema","title":"IoaAction","data":{"title":"IoaAction","type":"string","enum":["monitor","detect","block"],"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action the EDR takes when the IOA rule matches. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"block"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" maps to the strongest enforcement the provider supports for the rule type (for example Block Execution or Kill Process)."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/IoaQueryType":{"id":"components/schemas/IoaQueryType","kind":"json-schema","title":"IoaQueryType","data":{"title":"IoaQueryType","type":"string","enum":["event","correlation"],"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The kind of query a query-paradigm IOA rule evaluates (for example a SentinelOne STAR rule). "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"event"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" matches a single event; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"correlation"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" matches across multiple subqueries."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/IoaExpirationMode":{"id":"components/schemas/IoaExpirationMode","kind":"json-schema","title":"IoaExpirationMode","data":{"title":"IoaExpirationMode","type":"string","enum":["permanent","temporary"],"description":"Whether a query-paradigm IOA rule is permanent or expires at a set time."}},"components/schemas/IoaScope":{"id":"components/schemas/IoaScope","kind":"json-schema","title":"IoaScope","data":{"title":"IoaScope","type":"object","description":"The provider scope an IOA rule applies to. Required on create (and delete) by providers that scope rules to accounts, sites, or groups (for example SentinelOne). Ignored by providers that scope rules another way (for example CrowdStrike, which uses a rule group). When omitted, the provider adapter resolves a default scope from the credential where possible.","properties":{"account_ids":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Account ids the rule is scoped to."},"site_ids":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Site ids the rule is scoped to."},"group_ids":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Group ids the rule is scoped to."},"tenant":{"type":"boolean","nullable":true,"description":"When true, the rule is scoped to the entire tenant."}}}},"components/schemas/IoaFieldValueOption":{"id":"components/schemas/IoaFieldValueOption","kind":"json-schema","title":"IoaFieldValueOption","data":{"title":"IoaFieldValueOption","type":"object","properties":{"label":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Option label. For excludable fields this is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"include"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"exclude"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"; for set fields it is the option name."},"children":[],"type":"text"}],"type":"paragraph"}]},"value":{"type":"string","description":"The value to match for this option. For excludable fields this is a regular expression."}},"required":["label","value"]}},"components/schemas/IoaFieldValue":{"id":"components/schemas/IoaFieldValue","kind":"json-schema","title":"IoaFieldValue","data":{"title":"IoaFieldValue","type":"object","description":"A single field match expression for an IOA rule.","properties":{"name":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The provider field name to match on, for example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ImageFilename"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"CommandLine"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"label":{"type":"string","nullable":true,"description":"Human readable label for the field."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The provider field type, for example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"excludable"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"set"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"values":{"type":"array","items":{"$ref":"#/components/schemas/IoaFieldValueOption"},"description":"The match options for this field."}},"required":["name","values"]}},"components/schemas/IoaConditionOperator":{"id":"components/schemas/IoaConditionOperator","kind":"json-schema","title":"IoaConditionOperator","data":{"title":"IoaConditionOperator","type":"string","enum":["equals","not_equals","contains","starts_with","ends_with","matches","in"],"description":"How a condition field is compared to its values."}},"components/schemas/IoaCondition":{"id":"components/schemas/IoaCondition","kind":"json-schema","title":"IoaCondition","data":{"title":"IoaCondition","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A provider-neutral match expression for an IOA rule. The engine compiles the conditions list into the provider-native rule body (for example CrowdStrike field_values and rule_type, or a SentinelOne S1QL event query). Conditions are ANDed together, and all conditions in a rule must target a single activity category (process, file, or domain)."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"field":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Neutral field selector. Supported values: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"process.image.name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"process.command_line"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"parent_process.image.name"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"parent_process.command_line"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"file.path"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"network.domain"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Validated by the engine; kept as a string so new fields do not require an SDK regeneration."},"children":[],"type":"text"}],"type":"paragraph"}]},"operator":{"$ref":"#/components/schemas/IoaConditionOperator","description":"How the field is compared to the values."},"values":{"type":"array","items":{"type":"string"},"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Values to compare. Exactly one value unless the operator is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"in"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", which accepts one or more. For "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"matches"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" the value is a regular expression; for all other operators it is a literal."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["field","operator","values"]}},"components/schemas/Ioa":{"id":"components/schemas/Ioa","kind":"json-schema","title":"Ioa","data":{"title":"Ioa","type":"object","description":"An Indicator of Attack rule. IOA rules describe suspicious endpoint behavior (for example a process execution or network connection matching a pattern) and generate threat events when endpoint activity matches them.","properties":{"id":{"type":"string","nullable":true,"description":"The provider-assigned id of the rule. Set by the provider on responses; ignored on create."},"group_id":{"type":"string","nullable":true,"description":"The id of the provider rule group the rule belongs to. Optional on create; when omitted, the rule is added to a Synqly-managed group for the rule's platform, creating the group if necessary."},"group_name":{"type":"string","nullable":true,"description":"The name of the provider rule group the rule belongs to."},"name":{"type":"string","description":"The name of the rule."},"description":{"type":"string","nullable":true,"description":"A description of the behavior the rule detects."},"platform":{"$ref":"#/components/schemas/IoaPlatform","nullable":true,"description":"Required on create. May be absent on query responses when the provider rule uses a rule type Synqly does not model."},"rule_type":{"$ref":"#/components/schemas/IoaRuleType","nullable":true,"description":"Required on create. May be absent on query responses when the provider rule uses a rule type Synqly does not model."},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingSeverityId","nullable":true,"description":"OCSF severity id assigned to threat events generated by this rule. Supported values are 1 (Informational) through 5 (Critical); defaults to 3 (Medium). The OCSF ids 0 (Unknown), 6 (Fatal), and 99 (Other) are rejected because no supported EDR provider can represent them."},"action":{"$ref":"#/components/schemas/IoaAction","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Action taken when the rule matches. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"detect"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"enabled":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Whether the rule is enabled. On create this defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and the provider enables the rule (and its rule group, where applicable) on your behalf; set "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to create the rule disabled. Note that a rule may still require additional provider-side configuration (e.g. assigning its rule group to a prevention policy) before it takes effect."},"children":[],"type":"text"}],"type":"paragraph"}]},"deleted":{"type":"boolean","nullable":true,"description":"Whether the rule has been deleted. Set by the provider on responses."},"comment":{"type":"string","nullable":true,"description":"Audit log comment to associate with the rule."},"conditions":{"type":"array","items":{"$ref":"#/components/schemas/IoaCondition"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Provider-neutral match expressions (recommended on create). The engine compiles these into the provider-native rule: CrowdStrike field_values plus a derived rule_type, or a SentinelOne S1QL query. Mutually exclusive with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"field_values"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"query"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"platform"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is still required by providers that scope rules to a platform (for example CrowdStrike). Not populated on query responses."},"children":[],"type":"text"}],"type":"paragraph"}]},"field_values":{"type":"array","items":{"$ref":"#/components/schemas/IoaFieldValue"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The field match expressions that define the rule pattern (field_pattern paradigm, used by CrowdStrike). Required on create for those providers (a rule must declare at least one match expression) unless "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"conditions"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is provided. Mutually exclusive with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"conditions"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"query"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"; query-paradigm providers (for example SentinelOne) omit this."},"children":[],"type":"text"}],"type":"paragraph"}]},"query":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The rule query text (query paradigm, used by SentinelOne STAR and Microsoft Defender). Required on create for those providers unless "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"conditions"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is provided. Mutually exclusive with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"conditions"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"field_values"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"query_language":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The query language/version, for example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2.0"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for a SentinelOne STAR S1QL query."},"children":[],"type":"text"}],"type":"paragraph"}]},"query_type":{"$ref":"#/components/schemas/IoaQueryType","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The kind of query the rule evaluates. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"event"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"scope":{"$ref":"#/components/schemas/IoaScope","nullable":true,"description":"The provider scope the rule applies to. Required on create by providers that scope rules to accounts/sites/groups (for example SentinelOne). When omitted, the provider adapter resolves a default scope from the credential where possible."},"expiration_mode":{"$ref":"#/components/schemas/IoaExpirationMode","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Whether the rule is permanent or temporary. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"permanent"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"expires_time":{"type":"string","format":"date-time","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"When a temporary rule expires. Set by the provider on responses; required on create only when "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"expiration_mode"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"temporary"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"network_quarantine":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"When true, the rule triggers an automated network isolation response on match, where the provider supports it. Defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"provider_options":{"type":"object","additionalProperties":true,"nullable":true,"description":"Provider-specific rule options that have no common representation (for example SentinelOne correlation parameters, or Defender response action detail). Passed through on create and populated from the provider on responses."},"created_time":{"type":"string","format":"date-time","nullable":true,"description":"Time the rule was created. Set by the provider on responses."},"created_by":{"type":"string","nullable":true,"description":"User that created the rule. Set by the provider on responses."},"modified_time":{"type":"string","format":"date-time","nullable":true,"description":"Time the rule was last modified. Set by the provider on responses."},"modified_by":{"type":"string","nullable":true,"description":"User that last modified the rule. Set by the provider on responses."},"raw_data":{"type":"string","nullable":true,"description":"The rule data as received from the provider."}},"required":["name"]}},"components/schemas/QueryIoaResponse":{"id":"components/schemas/QueryIoaResponse","kind":"json-schema","title":"QueryIoaResponse","data":{"title":"QueryIoaResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/Ioa"},"description":"List of IOA rules that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/QueryExclusionsResponse":{"id":"components/schemas/QueryExclusionsResponse","kind":"json-schema","title":"QueryExclusionsResponse","data":{"title":"QueryExclusionsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0compliancefindingComplianceFinding"},"description":"List of exclusion findings that match the query, one per exclusion rule."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/QueryPoliciesResponse":{"id":"components/schemas/QueryPoliciesResponse","kind":"json-schema","title":"QueryPoliciesResponse","data":{"title":"QueryPoliciesResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0compliancefindingComplianceFinding"},"description":"List of policy findings that match the query, one per scope at the requested level of the policy tree."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/CreateIoaRequest":{"id":"components/schemas/CreateIoaRequest","kind":"json-schema","title":"CreateIoaRequest","data":{"title":"CreateIoaRequest","type":"object","properties":{"ioa":{"$ref":"#/components/schemas/Ioa","description":"The IOA rule to create."}},"required":["ioa"]}},"components/schemas/CreateIoaResponse":{"id":"components/schemas/CreateIoaResponse","kind":"json-schema","title":"CreateIoaResponse","data":{"title":"CreateIoaResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/Ioa","description":"The IOA rule that was created."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/DeleteIoaResponse":{"id":"components/schemas/DeleteIoaResponse","kind":"json-schema","title":"DeleteIoaResponse","data":{"title":"DeleteIoaResponse","type":"object","properties":{"result":{"type":"array","items":{"type":"string"},"description":"A list of ids of the IOA rules that were deleted."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/QueryPostureScoreResponse":{"id":"components/schemas/QueryPostureScoreResponse","kind":"json-schema","title":"QueryPostureScoreResponse","data":{"title":"QueryPostureScoreResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/PostureScore"},"description":"List of posture scores that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/GetEndpointResponse":{"id":"components/schemas/GetEndpointResponse","kind":"json-schema","title":"GetEndpointResponse","data":{"title":"GetEndpointResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/Device","description":"A single endpoint assets that match the Id."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/QueryEdrEventsResponse":{"id":"components/schemas/QueryEdrEventsResponse","kind":"json-schema","title":"QueryEdrEventsResponse","data":{"title":"QueryEdrEventsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/Event"},"description":"List of EDR events that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/GetThreatNotesResponse":{"id":"components/schemas/GetThreatNotesResponse","kind":"json-schema","title":"GetThreatNotesResponse","data":{"title":"GetThreatNotesResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0noteactivityNoteActivity"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/CreateThreatNoteRequest":{"id":"components/schemas/CreateThreatNoteRequest","kind":"json-schema","title":"CreateThreatNoteRequest","data":{"title":"CreateThreatNoteRequest","type":"object","properties":{"note":{"$ref":"#/components/schemas/ocsfv1.8.0noteactivityNoteActivity","description":"The note to create."}},"required":["note"]}},"components/schemas/CreateThreatNoteResponse":{"id":"components/schemas/CreateThreatNoteResponse","kind":"json-schema","title":"CreateThreatNoteResponse","data":{"title":"CreateThreatNoteResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/ocsfv1.8.0noteactivityNoteActivity"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/EmailSecurityThreat":{"id":"components/schemas/EmailSecurityThreat","kind":"json-schema","title":"ocsfv1.8.0detectionfindingDetectionFinding","data":{"title":"ocsfv1.8.0detectionfindingDetectionFinding","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the event producer is a security control, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile should be applied and its "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"attacks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" information, if present, should be duplicated into the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note: "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the Finding is an incident, i.e. requires incident workflow, also apply the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"incident"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile  or aggregate this finding into an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Incident Finding"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingActivityId","description":"The normalized identifier of the finding activity."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The finding activity name, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"anomaly_analyses":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0AnomalyAnalysis"},"nullable":true,"description":"Describes baseline information about normal activity patterns, along with any detected deviations or anomalies that triggered this finding."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"comment":{"type":"string","nullable":true,"description":"A user provided comment about the finding."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"device":{"$ref":"#/components/schemas/ocsfv1.8.0Device","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the affected device/host. If applicable, it can be used in conjunction with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Resource(s)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. Specific details about an AWS EC2 instance, that is affected by the Finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the most recent event included in the finding."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the most recent event included in the finding."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"evidences":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Evidences"},"nullable":true,"description":"Describes various evidence artifacts associated to the activity/activities that triggered a security detection."},"finding_info":{"$ref":"#/components/schemas/ocsfv1.8.0FindingInfo","description":"Describes the supporting information about a generated finding."},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"impact":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"impact_id":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingImpactId","nullable":true,"description":"The normalized impact of the incident or finding. Per NIST, this is the magnitude of harm that can be expected to result from the consequences of unauthorized disclosure, modification, destruction, or loss of information or information system availability."},"impact_score":{"type":"integer","nullable":true,"description":"The impact as an integer value of the finding, valid range 0-100."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. For example, an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of 'Create' could constitute an alertable signal and the value would be "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", while 'Close' likely would not and either omit the attribute or set its value to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":".  Note that other events with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile may also be deemed alertable signals and may also carry "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"is_alert = true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attributes."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"Describes malware reported in a Detection Finding."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about malware scan job that triggered this Detection Finding."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"remediation":{"$ref":"#/components/schemas/ocsfv1.8.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails"},"nullable":true,"description":"Describes details about resources that were the target of the activity that triggered the finding."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the least recent event included in the finding."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the least recent event included in the finding."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingStatusId","nullable":true,"description":"The normalized status identifier of the Finding, set by the consumer."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"vendor_attributes":{"$ref":"#/components/schemas/ocsfv1.8.0VendorAttributes","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability."},"children":[],"type":"text"}],"type":"paragraph"}]},"vulnerabilities":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Vulnerability"},"nullable":true,"description":"Describes vulnerabilities reported in a Detection Finding."}},"required":["activity_id","category_uid","class_uid","finding_info","metadata","severity_id","time","type_uid"]}},"components/schemas/EmailSecurityEmailEvent":{"id":"components/schemas/EmailSecurityEmailEvent","kind":"json-schema","title":"ocsfv1.8.0emailactivityEmailActivity","data":{"title":"ocsfv1.8.0emailactivityEmailActivity","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Email Activity events report SMTP protocol and email activities including those with embedded URLs and files. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Email"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object for details."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.8.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"attempt":{"type":"integer","nullable":true,"description":"The attempt number for attempting to deliver the email."},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"banner":{"type":"string","nullable":true,"description":"The initial connection response that a messaging server receives after it connects to an email server."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Network Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"command":{"type":"string","nullable":true,"description":"The command issued by the initiator (client), such as SMTP HELO or EHLO."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"device":{"$ref":"#/components/schemas/ocsfv1.8.0Device","nullable":true,"description":"An addressable device, computer system or host."},"direction":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The direction of the email, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"direction_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value."},"children":[],"type":"text"}],"type":"paragraph"}]},"direction_id":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityDirectionId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The direction of the email relative to the scanning host or organization."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"Email scanned at an internet gateway might be characterized as inbound to the organization from the Internet, outbound from the organization to the Internet, or internal within the organization. Email scanned at a workstation might be characterized as inbound to, or outbound from the workstation."},"children":[],"type":"text"}]},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint","nullable":true,"description":"The responder (server) receiving the email."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"email":{"$ref":"#/components/schemas/ocsfv1.8.0Email","description":"The email object."},"email_auth":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAuth","nullable":true,"description":"The SPF, DKIM and DMARC attributes of an email."},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"from":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress","nullable":true,"description":"The sender address from the transmission envelope. This reflects the actual sending party and may differ from the 'From' header in the message."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"message_trace_uid":{"type":"string","nullable":true,"description":"The identifier that tracks a message that travels through multiple points of a messaging service."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"protocol_name":{"type":"string","nullable":true,"description":"The Protocol Name specifies the email communication protocol, such as SMTP, IMAP, or POP3."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"smtp_hello":{"type":"string","nullable":true,"description":"The value of the SMTP HELO or EHLO command sent by the initiator (client)."},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint","nullable":true,"description":"The initiator (client) sending the email."},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"to":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress"},"nullable":true,"description":"The recipient address from the transmission envelope. This may differ from the 'To' header and represents where the message was actually delivered."},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","direction_id","email","metadata","severity_id","time","type_uid"]}},"components/schemas/EmailSecurityQueryThreatsResponse":{"id":"components/schemas/EmailSecurityQueryThreatsResponse","kind":"json-schema","title":"EmailSecurityQueryThreatsResponse","data":{"title":"EmailSecurityQueryThreatsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/EmailSecurityThreat"},"description":"List of threats"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/EmailSecurityGetThreatDetailsResponse":{"id":"components/schemas/EmailSecurityGetThreatDetailsResponse","kind":"json-schema","title":"EmailSecurityGetThreatDetailsResponse","data":{"title":"EmailSecurityGetThreatDetailsResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/EmailSecurityThreat","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The details of the threat matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"{threatId}"},"children":[],"type":"code"}],"type":"paragraph"}]}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/EmailSecurityQueryEmailEventsResponse":{"id":"components/schemas/EmailSecurityQueryEmailEventsResponse","kind":"json-schema","title":"EmailSecurityQueryEmailEventsResponse","data":{"title":"EmailSecurityQueryEmailEventsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/EmailSecurityEmailEvent"},"description":"List of email events"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/EndpointManagementDevice":{"id":"components/schemas/EndpointManagementDevice","kind":"json-schema","title":"ocsfv1.3.0inventoryinfoInventoryInfo","data":{"title":"ocsfv1.3.0inventoryinfoInventoryInfo","type":"object","description":"Device Inventory Info events report device inventory data that is either logged or proactively collected. For example, when collecting device information from a CMDB or running a network sweep of connected devices.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","description":"The device that is being discovered by an inventory process."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","device","metadata","severity_id","time","type_uid"]}},"components/schemas/ComplianceFinding":{"id":"components/schemas/ComplianceFinding","kind":"json-schema","title":"ocsfv1.3.0compliancefindingComplianceFinding","data":{"title":"ocsfv1.3.0compliancefindingComplianceFinding","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Compliance Finding events describe results of evaluations performed against resources, to check compliance with various Industry Frameworks or Security Standards such as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST SP 800-53, CIS AWS Foundations Benchmark v1.4.0, ISO/IEC 27001"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" etc."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingActivityId","description":"The normalized identifier of the finding activity."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The finding activity name, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"comment":{"type":"string","nullable":true,"description":"A user provided comment about the finding."},"compliance":{"$ref":"#/components/schemas/ocsfv1.3.0Compliance","description":"The compliance object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS, NIST etc.) and contains compliance related details."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the affected device/host. It can be used in conjunction with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Affected Resource(s)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. Specific details about an AWS EC2 instance, that is affected by the Finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time of the most recent event included in the finding."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the most recent event included in the finding."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"finding_info":{"$ref":"#/components/schemas/ocsfv1.3.0FindingInfo","description":"Describes the supporting information about a generated finding."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"remediation":{"$ref":"#/components/schemas/ocsfv1.3.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"resource":{"$ref":"#/components/schemas/ocsfv1.3.0ResourceDetails","nullable":true,"description":"Describes details about the resource that is the subject of the compliance check."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0ResourceDetails"},"nullable":true,"description":"Describes details about the resource/resouces that are the subject of the compliance check."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time of the least recent event included in the finding."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the least recent event included in the finding."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingStatusId","nullable":true,"description":"The normalized status identifier of the Finding, set by the consumer."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","compliance","finding_info","metadata","severity_id","time","type_uid"]}},"components/schemas/RemediationRequest":{"id":"components/schemas/RemediationRequest","kind":"json-schema","title":"RemediationRequest","data":{"title":"RemediationRequest","type":"object","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Synqly-unified action name. Portable across providers -- Synqly maps"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"it to the vendor-specific call. Use the capabilities API to discover"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"which actions each provider supports. Mutually exclusive with"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"vendor_action."},"children":[],"type":"text"}],"type":"paragraph"}]},"vendor_action":{"type":"string","nullable":true,"description":"Provider-specific action name, passed through to the vendor API\nwithout mapping. Use when the vendor supports actions not yet\ncovered by Synqly-unified names. Mutually exclusive with action."},"device_id":{"type":"string","nullable":true,"description":"Target device ID. Required for most actions."},"policy_id":{"type":"string","nullable":true,"description":"Target policy ID. Required for policy-scoped actions."},"comment":{"type":"string","nullable":true,"description":"Optional comment or reason for the action."},"params":{"type":"object","additionalProperties":true,"nullable":true,"description":"Action-specific parameters forwarded to the provider. See provider\ndocumentation for supported keys."}}}},"components/schemas/RemediateDeviceResponse":{"id":"components/schemas/RemediateDeviceResponse","kind":"json-schema","title":"RemediateDeviceResponse","data":{"title":"RemediateDeviceResponse","type":"object","properties":{"result":{"type":"string","nullable":true,"description":"Device ID that was acted on."}},"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/DeviceActionRequestBody":{"id":"components/schemas/DeviceActionRequestBody","kind":"json-schema","title":"DeviceActionRequestBody","data":{"title":"DeviceActionRequestBody","type":"object","properties":{"device_id":{"type":"string","description":"Target device ID."},"comment":{"type":"string","nullable":true,"description":"Optional comment or reason for the action."},"params":{"type":"object","additionalProperties":true,"nullable":true,"description":"Action-specific parameters forwarded to the provider."}},"required":["device_id"]}},"components/schemas/DeviceActionResponse":{"id":"components/schemas/DeviceActionResponse","kind":"json-schema","title":"DeviceActionResponse","data":{"title":"DeviceActionResponse","type":"object","properties":{"result":{"type":"string","nullable":true,"description":"Device ID that was acted on."}},"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/QueryEndpointManagementDevicesResponse":{"id":"components/schemas/QueryEndpointManagementDevicesResponse","kind":"json-schema","title":"QueryEndpointManagementDevicesResponse","data":{"title":"QueryEndpointManagementDevicesResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/EndpointManagementDevice"},"description":"List of devices that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/GetEndpointManagementDeviceResponse":{"id":"components/schemas/GetEndpointManagementDeviceResponse","kind":"json-schema","title":"GetEndpointManagementDeviceResponse","data":{"title":"GetEndpointManagementDeviceResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/EndpointManagementDevice","description":"A single device matching the ID."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/QueryDeviceComplianceResponse":{"id":"components/schemas/QueryDeviceComplianceResponse","kind":"json-schema","title":"QueryDeviceComplianceResponse","data":{"title":"QueryDeviceComplianceResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ComplianceFinding"},"description":"List of compliance findings that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/QueryDeviceApplicationsResponse":{"id":"components/schemas/QueryDeviceApplicationsResponse","kind":"json-schema","title":"QueryDeviceApplicationsResponse","data":{"title":"QueryDeviceApplicationsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0softwareinfoSoftwareInfo"},"description":"List of applications installed on the device."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/BaseResourceRequest":{"id":"components/schemas/BaseResourceRequest","kind":"json-schema","title":"BaseResourceRequest","data":{"title":"BaseResourceRequest","type":"object","properties":{"name":{"type":"string","description":"Human-readable name for this resource"}},"required":["name"]}},"components/schemas/OptionValue":{"id":"components/schemas/OptionValue","kind":"json-schema","title":"OptionValue","data":{"title":"OptionValue","type":"object","description":"Represents a possible option from a set of choices, such as an enum value. The choices may have separate display names and IDs.","properties":{"id":{"$ref":"#/components/schemas/Id"},"name":{"type":"string"},"attributes":{"type":"object","additionalProperties":true,"nullable":true,"description":"Provider-specific details about this option, such as the workflow state type and position of a Linear status."}},"required":["id","name"]}},"components/schemas/APIResponse":{"id":"components/schemas/APIResponse","kind":"json-schema","title":"APIResponse","data":{"title":"APIResponse","type":"object","properties":{"messages":{"$ref":"#/components/schemas/MessagesResponse","nullable":true,"description":"Additional messages from the service response that may be helpful to the client."},"meta":{"$ref":"#/components/schemas/MetaResponse","nullable":true,"description":"Various metadata about the results organized by group, then type, then field."}}}},"components/schemas/APIQueryResponse":{"id":"components/schemas/APIQueryResponse","kind":"json-schema","title":"APIQueryResponse","data":{"title":"APIQueryResponse","type":"object","properties":{"cursor":{"type":"string","description":"Cursor to use to retrieve the next page of results"}},"required":["cursor"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/APIHasStatus":{"id":"components/schemas/APIHasStatus","kind":"json-schema","title":"APIHasStatus","data":{"title":"APIHasStatus","type":"object","properties":{"status":{"$ref":"#/components/schemas/QueryStatus","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the provider supports asynchronous queries and the query is still running, this field will be "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"PENDING"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" until the query is complete. In this case, the client should retry using the provided cursor."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["status"]}},"components/schemas/MessagesResponse":{"id":"components/schemas/MessagesResponse","kind":"json-schema","title":"MessagesResponse","data":{"title":"MessagesResponse","type":"object","properties":{"problems":{"type":"array","items":{"$ref":"#/components/schemas/Problem"},"nullable":true,"description":"Warnings or issues that occurred during processing that did not prevent the request from returning, but may indicate a problem or issue with expected processing behavior."}}}},"components/schemas/MetaResponse":{"id":"components/schemas/MetaResponse","kind":"json-schema","title":"MetaResponse","data":{"title":"MetaResponse","type":"object","properties":{"stats":{"$ref":"#/components/schemas/MetaStats","nullable":true,"description":"Statistics about items contained in the response."},"api":{"$ref":"#/components/schemas/MetaApi","nullable":true,"description":"Information about backing API requests made to fulfill the response."},"mapping":{"$ref":"#/components/schemas/MetaMapping","nullable":true,"description":"Information about mappings applied during transformation."}}}},"components/schemas/MetaStats":{"id":"components/schemas/MetaStats","kind":"json-schema","title":"MetaStats","data":{"title":"MetaStats","type":"object","properties":{"count":{"type":"object","additionalProperties":{"type":"integer","format":"int64"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A count of total response times. If present \"*\" will be all items, or they can be faceted into specific categories."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/MetaApi":{"id":"components/schemas/MetaApi","kind":"json-schema","title":"MetaApi","data":{"title":"MetaApi","type":"object","properties":{"response":{"$ref":"#/components/schemas/MetaApiResponse","nullable":true}}}},"components/schemas/MetaApiResponse":{"id":"components/schemas/MetaApiResponse","kind":"json-schema","title":"MetaApiResponse","data":{"title":"MetaApiResponse","type":"object","properties":{"primary":{"$ref":"#/components/schemas/MetaApiPrimaryResponse","nullable":true},"list":{"type":"object","additionalProperties":{"type":"array","items":{"type":"string"}},"nullable":true,"description":"All responses from backing API calls, indexed by endpoint URL."}}}},"components/schemas/MetaApiPrimaryResponse":{"id":"components/schemas/MetaApiPrimaryResponse","kind":"json-schema","title":"MetaApiPrimaryResponse","data":{"title":"MetaApiPrimaryResponse","type":"object","properties":{"endpoint":{"type":"string","description":"The endpoint URL of the primary API request made to fulfill the response."},"response":{"type":"string","description":"The response from the primary API request."}},"required":["endpoint","response"]}},"components/schemas/MetaMapping":{"id":"components/schemas/MetaMapping","kind":"json-schema","title":"MetaMapping","data":{"title":"MetaMapping","type":"object","properties":{"chains":{"$ref":"#/components/schemas/MetaMappingChains","nullable":true,"description":"Mapping chains applied for any transformation that were performed during the request."}}}},"components/schemas/MetaMappingChains":{"id":"components/schemas/MetaMappingChains","kind":"json-schema","title":"MetaMappingChains","data":{"title":"MetaMappingChains","type":"object","additionalProperties":{"type":"array","items":{"type":"string"}},"description":"The list of mapping chains applied, indexed by operation ID. Each entry contains an array of mapping IDs."}},"components/schemas/Object":{"id":"components/schemas/Object","kind":"json-schema","title":"Object","data":{"title":"Object","type":"object","additionalProperties":true,"description":"The Object type is used to represent an object with arbitrary fields. The keys are strings and the values are any type."}},"components/schemas/QueryStatus":{"id":"components/schemas/QueryStatus","kind":"json-schema","title":"QueryStatus","data":{"title":"QueryStatus","type":"string","enum":["PENDING","COMPLETE"]}},"components/schemas/Event":{"id":"components/schemas/Event","kind":"json-schema","title":"Event","data":{"title":"Event","oneOf":[{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Account Change"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0accountchangeAccountChange"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["API Activity"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0apiactivityApiActivity"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Application Security Posture Finding"]}}},{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingApplicationSecurityPostureFinding"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Entity Management"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0entitymanagementEntityManagement"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Authentication"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0authenticationAuthentication"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Authorize Session"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0authorizesessionAuthorizeSession"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Base Event"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0baseeventBaseEvent"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Compliance Finding"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingComplianceFinding"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Device Config State"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0configstateConfigState"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Detection Finding"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingDetectionFinding"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["DNS Activity"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0dnsactivityDnsActivity"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["HTTP Activity"]}}},{"$ref":"#/components/schemas/ocsfv1.6.0httpactivityHttpActivity"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["File System Activity"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0fileactivityFileActivity"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Group Management"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0groupmanagementGroupManagement"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Incident Finding"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0incidentfindingIncidentFinding"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Device Inventory Info"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoInventoryInfo"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Module Activity"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0moduleactivityModuleActivity"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Network Activity"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0networkactivityNetworkActivity"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Process Activity"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0processactivityProcessActivity"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Scan Activity"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0scanactivityScanActivity"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Scheduled Job Activity"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0scheduledjobactivityScheduledJobActivity"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Security Finding"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingSecurityFinding"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Software Info"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0softwareinfoSoftwareInfo"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["User Access Management"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0useraccessmanagementUserAccess"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Vulnerability Finding"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0vulnerabilityfindingVulnerabilityFinding"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Web Resource Access Activity"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0webresourceaccessactivityWebResourceAccessActivity"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Application Lifecycle"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0applicationlifecycleApplicationLifecycle"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["File Hosting Activity"]}}},{"$ref":"#/components/schemas/ocsfv1.6.0filehostingactivityFileHosting"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Email Activity"]}}},{"$ref":"#/components/schemas/ocsfv1.6.0emailactivityEmailActivity"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Cloud Activity"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0cloudactivityCloudActivity"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Cloud Resources Inventory Info"]}}},{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Note Activity"]}}},{"$ref":"#/components/schemas/ocsfv1.8.0noteactivityNoteActivity"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Software Inventory Info"]}}},{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoSoftwareInfo"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Chat Message Activity"]}}},{"$ref":"#/components/schemas/ocsfv1.8.0chatmessageactivityChatMessageActivity"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Conversation Activity"]}}},{"$ref":"#/components/schemas/ocsfv1.8.0conversationactivityConversationActivity"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Application Inventory Info"]}}},{"$ref":"#/components/schemas/ocsfv1.8.0applicationinventoryinfoApplicationInventoryInfo"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Access Grant Inventory Info"]}}},{"$ref":"#/components/schemas/ocsfv1.8.0accessgrantinventoryinfoAccessGrantInventoryInfo"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Compliance Control Inventory Info"]}}},{"$ref":"#/components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoComplianceControlInventoryInfo"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Compliance Framework Inventory Info"]}}},{"$ref":"#/components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoComplianceFrameworkInventoryInfo"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Compliance Test Inventory Info"]}}},{"$ref":"#/components/schemas/ocsfv1.8.0compliancetestinventoryinfoComplianceTestInventoryInfo"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Compliance Evidence Inventory Info"]}}},{"$ref":"#/components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoComplianceEvidenceInventoryInfo"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Event Log Activity"]}}},{"$ref":"#/components/schemas/ocsfv1.3.0eventlogactivityEventLog"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Training Campaign Inventory Info"]}}},{"$ref":"#/components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoTrainingCampaignInventoryInfo"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["Phishing Simulation Inventory Info"]}}},{"$ref":"#/components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoPhishingSimulationInventoryInfo"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["User Inventory Info"]}}},{"$ref":"#/components/schemas/ocsfv1.8.0userinventoryUserInventory"}],"required":["class_name"]},{"type":"object","allOf":[{"type":"object","properties":{"class_name":{"type":"string","enum":["OSINT Inventory Info"]}}},{"$ref":"#/components/schemas/ocsfv1.8.0osintinventoryinfoOsintInventoryInfo"}],"required":["class_name"]}]}},"components/schemas/GrcControlId":{"id":"components/schemas/GrcControlId","kind":"json-schema","title":"Id","data":{"title":"Id","type":"string"}},"components/schemas/GrcTestId":{"id":"components/schemas/GrcTestId","kind":"json-schema","title":"Id","data":{"title":"Id","type":"string"}},"components/schemas/GrcPersonnelId":{"id":"components/schemas/GrcPersonnelId","kind":"json-schema","title":"Id","data":{"title":"Id","type":"string"}},"components/schemas/GrcDeviceId":{"id":"components/schemas/GrcDeviceId","kind":"json-schema","title":"Id","data":{"title":"Id","type":"string"}},"components/schemas/GrcFramework":{"id":"components/schemas/GrcFramework","kind":"json-schema","title":"ocsfv1.8.0complianceframeworkinventoryinfoComplianceFrameworkInventoryInfo","data":{"title":"ocsfv1.8.0complianceframeworkinventoryinfoComplianceFrameworkInventoryInfo","type":"object","description":"Compliance Framework Inventory Info events report the compliance standards and regulatory frameworks an organization is tracking in a GRC platform, along with aggregate posture counts. For example, when listing the frameworks in scope in a compliance-automation tool.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"compliance_framework":{"$ref":"#/components/schemas/ocsfv1.8.0ComplianceFramework","description":"The compliance framework that was discovered."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time, or the time the framework inventory was collected."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time, or the time the framework inventory was collected."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","compliance_framework","metadata","severity_id","time","type_uid"]}},"components/schemas/GrcControl":{"id":"components/schemas/GrcControl","kind":"json-schema","title":"ocsfv1.8.0compliancecontrolinventoryinfoComplianceControlInventoryInfo","data":{"title":"ocsfv1.8.0compliancecontrolinventoryinfoComplianceControlInventoryInfo","type":"object","description":"Compliance Control Inventory Info events report the compliance controls defined in a GRC platform, along with their framework mappings and current status. For example, when listing the controls tracked in a compliance-automation tool.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"compliance_control":{"$ref":"#/components/schemas/ocsfv1.8.0ComplianceControl","description":"The compliance control that was discovered."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time, or the time the control inventory was collected."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time, or the time the control inventory was collected."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","compliance_control","metadata","severity_id","time","type_uid"]}},"components/schemas/GrcTest":{"id":"components/schemas/GrcTest","kind":"json-schema","title":"ocsfv1.8.0compliancetestinventoryinfoComplianceTestInventoryInfo","data":{"title":"ocsfv1.8.0compliancetestinventoryinfoComplianceTestInventoryInfo","type":"object","description":"Compliance Test Inventory Info events report the automated tests defined in a GRC platform, along with their current pass/fail status and the controls they validate. For example, when listing the tests in a compliance-automation tool.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancetestinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0compliancetestinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0compliancetestinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"compliance_test":{"$ref":"#/components/schemas/ocsfv1.8.0ComplianceTest","description":"The compliance test that was discovered."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancetestinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancetestinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time, or the time the test inventory was collected."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time, or the time the test inventory was collected."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0compliancetestinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","compliance_test","metadata","severity_id","time","type_uid"]}},"components/schemas/GrcEvidence":{"id":"components/schemas/GrcEvidence","kind":"json-schema","title":"ocsfv1.8.0complianceevidenceinventoryinfoComplianceEvidenceInventoryInfo","data":{"title":"ocsfv1.8.0complianceevidenceinventoryinfoComplianceEvidenceInventoryInfo","type":"object","description":"Compliance Evidence Inventory Info events report the documentation artifacts collected in a GRC platform to prove controls are working, along with the controls or tests they support. For example, when listing the evidence attached to tests in a compliance-automation tool.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"compliance_evidence":{"$ref":"#/components/schemas/ocsfv1.8.0ComplianceEvidence","description":"The compliance evidence that was discovered."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time, or the time the evidence inventory was collected."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time, or the time the evidence inventory was collected."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","compliance_evidence","metadata","severity_id","time","type_uid"]}},"components/schemas/GrcComplianceFinding":{"id":"components/schemas/GrcComplianceFinding","kind":"json-schema","title":"ocsfv1.8.0compliancefindingComplianceFinding","data":{"title":"ocsfv1.8.0compliancefindingComplianceFinding","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Compliance Finding events describe results of evaluations performed against resources, to check compliance with various Industry Frameworks or Security Standards such as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST SP 800-53, CIS AWS Foundations Benchmark v1.4.0, ISO/IEC 27001"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" etc. Note: if the event producer is a security control, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile should be applied and its "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"attacks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" information, if present, should be duplicated into the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note: "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the Finding is an incident, i.e. requires incident workflow, also apply the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"incident"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile or aggregate this finding into an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Incident Finding"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancefindingActivityId","description":"The normalized identifier of the finding activity."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The finding activity name, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0compliancefindingCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0compliancefindingClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"comment":{"type":"string","nullable":true,"description":"A user provided comment about the finding."},"compliance":{"$ref":"#/components/schemas/ocsfv1.8.0Compliance","description":"The compliance object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS, NIST etc.) and contains compliance related details."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancefindingConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"device":{"$ref":"#/components/schemas/ocsfv1.8.0Device","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the affected device/host. If applicable, it can be used in conjunction with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Resource(s)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. Specific details about an AWS EC2 instance, that is affected by the Finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the most recent event included in the finding."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the most recent event included in the finding."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"evidences":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Evidences"},"nullable":true,"description":"Describes various evidence artifacts associated with the compliance finding."},"finding_info":{"$ref":"#/components/schemas/ocsfv1.8.0FindingInfo","description":"Describes the supporting information about a generated finding."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"remediation":{"$ref":"#/components/schemas/ocsfv1.8.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"resource":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails","nullable":true,"description":"Describes details about the resource that is the subject of the compliance check."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails"},"nullable":true,"description":"Describes details about the resource/resources that are the subject of the compliance check."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancefindingSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the least recent event included in the finding."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the least recent event included in the finding."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancefindingStatusId","nullable":true,"description":"The normalized status identifier of the Finding, set by the consumer."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0compliancefindingTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"vendor_attributes":{"$ref":"#/components/schemas/ocsfv1.8.0VendorAttributes","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["activity_id","category_uid","class_uid","compliance","finding_info","metadata","severity_id","time","type_uid"]}},"components/schemas/GrcQueryFrameworksResponse":{"id":"components/schemas/GrcQueryFrameworksResponse","kind":"json-schema","title":"GrcQueryFrameworksResponse","data":{"title":"GrcQueryFrameworksResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/GrcFramework"},"description":"List of compliance frameworks that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"in-development"}},"components/schemas/GrcQueryControlsResponse":{"id":"components/schemas/GrcQueryControlsResponse","kind":"json-schema","title":"GrcQueryControlsResponse","data":{"title":"GrcQueryControlsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/GrcControl"},"description":"List of compliance controls that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"in-development"}},"components/schemas/GrcGetControlResponse":{"id":"components/schemas/GrcGetControlResponse","kind":"json-schema","title":"GrcGetControlResponse","data":{"title":"GrcGetControlResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/GrcControl","description":"The requested compliance control."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}],"x-fern-availability":"in-development"}},"components/schemas/GrcQueryTestsResponse":{"id":"components/schemas/GrcQueryTestsResponse","kind":"json-schema","title":"GrcQueryTestsResponse","data":{"title":"GrcQueryTestsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/GrcTest"},"description":"List of compliance tests that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"in-development"}},"components/schemas/GrcGetTestResponse":{"id":"components/schemas/GrcGetTestResponse","kind":"json-schema","title":"GrcGetTestResponse","data":{"title":"GrcGetTestResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/GrcTest","description":"The requested compliance test."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}],"x-fern-availability":"in-development"}},"components/schemas/GrcQueryEvidenceResponse":{"id":"components/schemas/GrcQueryEvidenceResponse","kind":"json-schema","title":"GrcQueryEvidenceResponse","data":{"title":"GrcQueryEvidenceResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/GrcEvidence"},"description":"List of compliance evidence artifacts that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"in-development"}},"components/schemas/GrcQueryDevicesResponse":{"id":"components/schemas/GrcQueryDevicesResponse","kind":"json-schema","title":"GrcQueryDevicesResponse","data":{"title":"GrcQueryDevicesResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/GrcComplianceFinding"},"description":"List of device compliance findings that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"in-development"}},"components/schemas/GrcGetDeviceResponse":{"id":"components/schemas/GrcGetDeviceResponse","kind":"json-schema","title":"GrcGetDeviceResponse","data":{"title":"GrcGetDeviceResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/GrcComplianceFinding","description":"The compliance finding for the requested device."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}],"x-fern-availability":"in-development"}},"components/schemas/GrcQueryPersonnelResponse":{"id":"components/schemas/GrcQueryPersonnelResponse","kind":"json-schema","title":"GrcQueryPersonnelResponse","data":{"title":"GrcQueryPersonnelResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/GrcComplianceFinding"},"description":"List of personnel compliance findings that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"in-development"}},"components/schemas/GrcGetPersonnelResponse":{"id":"components/schemas/GrcGetPersonnelResponse","kind":"json-schema","title":"GrcGetPersonnelResponse","data":{"title":"GrcGetPersonnelResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/GrcComplianceFinding","description":"The compliance finding for the requested person."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}],"x-fern-availability":"in-development"}},"components/schemas/QueryIdentityAuditLogResponse":{"id":"components/schemas/QueryIdentityAuditLogResponse","kind":"json-schema","title":"QueryIdentityAuditLogResponse","data":{"title":"QueryIdentityAuditLogResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/Event"},"description":"List of events from the audit log. Each event will be one of the OCSF Types Account Change, Authentication, or Group Management."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/QueryIdentityRiskEventsResponse":{"id":"components/schemas/QueryIdentityRiskEventsResponse","kind":"json-schema","title":"QueryIdentityRiskEventsResponse","data":{"title":"QueryIdentityRiskEventsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/Event"},"description":"Identity threat / risk events (for example Microsoft Entra Identity Protection risk detections) normalized to OCSF."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/QueryIdentityRiskyUsersResponse":{"id":"components/schemas/QueryIdentityRiskyUsersResponse","kind":"json-schema","title":"QueryIdentityRiskyUsersResponse","data":{"title":"QueryIdentityRiskyUsersResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsflatestEntityManagement"},"description":"Risky users from the identity provider (for example Microsoft Entra Identity Protection rolled-up user risk), each wrapped in an OCSF Entity Management Read event."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/QueryIdentityApplicationsResponse":{"id":"components/schemas/QueryIdentityApplicationsResponse","kind":"json-schema","title":"QueryIdentityApplicationsResponse","data":{"title":"QueryIdentityApplicationsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsflatestApplicationInventoryInfo"},"description":"Applications registered in, or connected to, the identity provider, each wrapped in an OCSF Application Inventory Info event."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"in-development"}},"components/schemas/QueryIdentityAccessGrantsResponse":{"id":"components/schemas/QueryIdentityAccessGrantsResponse","kind":"json-schema","title":"QueryIdentityAccessGrantsResponse","data":{"title":"QueryIdentityAccessGrantsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsflatestAccessGrantInventoryInfo"},"description":"Standing access held by principals in the identity provider, one per grant as the provider records it, each wrapped in an OCSF Access Grant Inventory Info event."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"in-development"}},"components/schemas/QueryIdentityPoliciesResponse":{"id":"components/schemas/QueryIdentityPoliciesResponse","kind":"json-schema","title":"QueryIdentityPoliciesResponse","data":{"title":"QueryIdentityPoliciesResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0compliancefindingComplianceFinding"},"description":"Identity policies that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"in-development"}},"components/schemas/QueryUsersResponse":{"id":"components/schemas/QueryUsersResponse","kind":"json-schema","title":"QueryUsersResponse","data":{"title":"QueryUsersResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsflatestEntityManagement"},"description":"List users wrapped in the OCSF Entity Management event of type Read."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/GetUserResponse":{"id":"components/schemas/GetUserResponse","kind":"json-schema","title":"GetUserResponse","data":{"title":"GetUserResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/ocsflatestEntityManagement"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/QueryGroupsResponse":{"id":"components/schemas/QueryGroupsResponse","kind":"json-schema","title":"QueryGroupsResponse","data":{"title":"QueryGroupsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsflatestEntityManagement"},"description":"List groups wrapped in the OCSF Entity Management event of type Read."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/GetGroupResponse":{"id":"components/schemas/GetGroupResponse","kind":"json-schema","title":"GetGroupResponse","data":{"title":"GetGroupResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/ocsflatestEntityManagement"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/GetGroupMembersResponse":{"id":"components/schemas/GetGroupMembersResponse","kind":"json-schema","title":"GetGroupMembersResponse","data":{"title":"GetGroupMembersResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsflatestEntityManagement"},"description":"List of users wrapped in the OCSF Entity Management event of type Read that are members in the group referenced by ID."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/UserId":{"id":"components/schemas/UserId","kind":"json-schema","title":"UserId","data":{"title":"UserId","type":"string","description":"The unique identifier for a user in the identity provider's system"}},"components/schemas/GroupId":{"id":"components/schemas/GroupId","kind":"json-schema","title":"GroupId","data":{"title":"GroupId","type":"string","description":"The unique identifier for a group in the identity provider's system"}},"components/schemas/IncidentResponseUserReference":{"id":"components/schemas/IncidentResponseUserReference","kind":"json-schema","title":"IncidentResponseUserReference","data":{"title":"IncidentResponseUserReference","type":"object","properties":{"name":{"type":"string","nullable":true,"description":"The name of the incident response user being referenced."},"desc":{"type":"string","nullable":true,"description":"The description of the incident response user being referenced."},"uid":{"$ref":"#/components/schemas/Id","description":"The unique identifier for the incident response user being referenced."},"src_url":{"type":"string","nullable":true,"description":"A deep-linked url to the incident response user in a providers interface."}},"required":["uid"],"x-fern-availability":"in-development"}},"components/schemas/IncidentResponseTeamReference":{"id":"components/schemas/IncidentResponseTeamReference","kind":"json-schema","title":"IncidentResponseTeamReference","data":{"title":"IncidentResponseTeamReference","type":"object","properties":{"name":{"type":"string","nullable":true,"description":"The name of the incident response team being referenced."},"desc":{"type":"string","nullable":true,"description":"The description of the incident response team being referenced."},"uid":{"$ref":"#/components/schemas/Id","description":"The unique identifier for the incident response team being referenced."},"src_url":{"type":"string","nullable":true,"description":"A deep-linked url to the incident response team in a providers interface."}},"required":["uid"],"x-fern-availability":"in-development"}},"components/schemas/IncidentResponseScheduleReference":{"id":"components/schemas/IncidentResponseScheduleReference","kind":"json-schema","title":"IncidentResponseScheduleReference","data":{"title":"IncidentResponseScheduleReference","type":"object","properties":{"name":{"type":"string","nullable":true,"description":"The name of the incident response schedule being referenced."},"desc":{"type":"string","nullable":true,"description":"The description of the incident response schedule being referenced."},"uid":{"$ref":"#/components/schemas/Id","description":"The unique identifier for the incident response schedule being referenced."},"src_url":{"type":"string","nullable":true,"description":"A deep-linked url to the incident response schedule in a providers interface."}},"required":["uid"],"x-fern-availability":"in-development"}},"components/schemas/IncidentResponseEscalationTargetUnion":{"id":"components/schemas/IncidentResponseEscalationTargetUnion","kind":"json-schema","title":"IncidentResponseEscalationTargetUnion","data":{"title":"IncidentResponseEscalationTargetUnion","oneOf":[{"type":"object","allOf":[{"type":"object","properties":{"type":{"type":"string","enum":["incident_response_user"]}}},{"$ref":"#/components/schemas/IncidentResponseUser"}],"required":["type"]},{"type":"object","allOf":[{"type":"object","properties":{"type":{"type":"string","enum":["incident_response_team"]}}},{"$ref":"#/components/schemas/IncidentResponseTeam"}],"required":["type"]},{"type":"object","allOf":[{"type":"object","properties":{"type":{"type":"string","enum":["incident_response_schedule"]}}},{"$ref":"#/components/schemas/IncidentResponseSchedule"}],"required":["type"]},{"type":"object","allOf":[{"type":"object","properties":{"type":{"type":"string","enum":["incident_response_user_reference"]}}},{"$ref":"#/components/schemas/IncidentResponseUserReference"}],"required":["type"]},{"type":"object","allOf":[{"type":"object","properties":{"type":{"type":"string","enum":["incident_response_team_reference"]}}},{"$ref":"#/components/schemas/IncidentResponseTeamReference"}],"required":["type"]},{"type":"object","allOf":[{"type":"object","properties":{"type":{"type":"string","enum":["incident_response_schedule_reference"]}}},{"$ref":"#/components/schemas/IncidentResponseScheduleReference"}],"required":["type"]}],"x-fern-availability":"in-development"}},"components/schemas/IncidentResponseTeamUnion":{"id":"components/schemas/IncidentResponseTeamUnion","kind":"json-schema","title":"IncidentResponseTeamUnion","data":{"title":"IncidentResponseTeamUnion","oneOf":[{"type":"object","allOf":[{"type":"object","properties":{"type":{"type":"string","enum":["incident_response_team"]}}},{"$ref":"#/components/schemas/IncidentResponseTeam"}],"required":["type"]},{"type":"object","allOf":[{"type":"object","properties":{"type":{"type":"string","enum":["incident_response_team_reference"]}}},{"$ref":"#/components/schemas/IncidentResponseTeamReference"}],"required":["type"]}],"x-fern-availability":"in-development"}},"components/schemas/IncidentResponseUserUnion":{"id":"components/schemas/IncidentResponseUserUnion","kind":"json-schema","title":"IncidentResponseUserUnion","data":{"title":"IncidentResponseUserUnion","oneOf":[{"type":"object","allOf":[{"type":"object","properties":{"type":{"type":"string","enum":["incident_response_user"]}}},{"$ref":"#/components/schemas/IncidentResponseUser"}],"required":["type"]},{"type":"object","allOf":[{"type":"object","properties":{"type":{"type":"string","enum":["incident_response_user_reference"]}}},{"$ref":"#/components/schemas/IncidentResponseUserReference"}],"required":["type"]}],"x-fern-availability":"in-development"}},"components/schemas/IncidentResponseUser":{"id":"components/schemas/IncidentResponseUser","kind":"json-schema","title":"IncidentResponseUser","data":{"title":"IncidentResponseUser","type":"object","properties":{"email_addr":{"type":"string","nullable":true,"description":"The email address of the incident response user."},"teams":{"type":"array","items":{"$ref":"#/components/schemas/IncidentResponseTeamUnion"},"nullable":true,"description":"The incident response teams that the incident response user is a member of."},"name":{"type":"string","nullable":true,"description":"The name of the incident response user."},"uid":{"$ref":"#/components/schemas/Id","description":"The unique identifier for the incident response user."},"timezone":{"type":"string","nullable":true,"description":"The timezone of the incident response user. This value is represented as a IANA timezone string."},"job_title":{"type":"string","nullable":true,"description":"The job title of the incident response user."},"src_url":{"type":"string","nullable":true,"description":"A deep-linked url to the incident response user in a providers interface."},"unmapped":{"$ref":"#/components/schemas/Object","nullable":true,"description":"The attributes that are not mapped to the incident response user schema. The names and values of those attributes are specific to each provider."}},"required":["uid"],"x-fern-availability":"in-development"}},"components/schemas/IncidentResponseSchedule":{"id":"components/schemas/IncidentResponseSchedule","kind":"json-schema","title":"IncidentResponseSchedule","data":{"title":"IncidentResponseSchedule","type":"object","properties":{"desc":{"type":"string","nullable":true,"description":"The description of the incident response schedule."},"name":{"type":"string","nullable":true,"description":"The name of the incident response schedule."},"src_url":{"type":"string","nullable":true,"description":"A deep-linked url to the incident response schedule in a providers interface."},"uid":{"$ref":"#/components/schemas/Id","description":"The unique identifier for the incident response schedule."},"teams":{"type":"array","items":{"$ref":"#/components/schemas/IncidentResponseTeamUnion"},"nullable":true,"description":"The incident response teams that own or are a part of the incident response schedule."},"users":{"type":"array","items":{"$ref":"#/components/schemas/IncidentResponseUserUnion"},"nullable":true,"description":"The incident response users that are a part of the incident response schedule."},"unmapped":{"$ref":"#/components/schemas/Object","nullable":true,"description":"The attributes that are not mapped to the incident response user schema. The names and values of those attributes are specific to each provider."}},"required":["uid"],"x-fern-availability":"in-development"}},"components/schemas/IncidentResponseTeam":{"id":"components/schemas/IncidentResponseTeam","kind":"json-schema","title":"IncidentResponseTeam","data":{"title":"IncidentResponseTeam","type":"object","properties":{"desc":{"type":"string","nullable":true,"description":"The description of the incident response team."},"name":{"type":"string","nullable":true,"description":"The name of the incident response team."},"src_url":{"type":"string","nullable":true,"description":"A deep-linked url to the incident response team in a providers interface."},"uid":{"$ref":"#/components/schemas/Id","description":"The unique identifier for the incident response team."},"unmapped":{"$ref":"#/components/schemas/Object","nullable":true,"description":"The attributes that are not mapped to the incident response user schema. The names and values of those attributes are specific to each provider."}},"required":["uid"],"x-fern-availability":"in-development"}},"components/schemas/IncidentResponseEscalationRule":{"id":"components/schemas/IncidentResponseEscalationRule","kind":"json-schema","title":"IncidentResponseEscalationRule","data":{"title":"IncidentResponseEscalationRule","type":"object","properties":{"escalation_delay":{"type":"integer","nullable":true,"description":"The delay in milliseconds before the next target is notified."},"targets":{"type":"array","items":{"$ref":"#/components/schemas/IncidentResponseEscalationTargetUnion"},"nullable":true,"description":"The targets to notify."},"uid":{"$ref":"#/components/schemas/Id","description":"The unique identifier for the escalation rule."},"unmapped":{"$ref":"#/components/schemas/Object","nullable":true,"description":"The attributes that are not mapped to the incident response user schema. The names and values of those attributes are specific to each provider."}},"required":["uid"],"x-fern-availability":"in-development"}},"components/schemas/IncidentResponseEscalationPolicy":{"id":"components/schemas/IncidentResponseEscalationPolicy","kind":"json-schema","title":"IncidentResponseEscalationPolicy","data":{"title":"IncidentResponseEscalationPolicy","type":"object","properties":{"created_time":{"type":"integer","nullable":true,"description":"A Unix timestamp in milliseconds representing the time the escalation policy was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The human readable time the escalation policy was created."},"desc":{"type":"string","nullable":true,"description":"The description of the escalation policy."},"name":{"type":"string","nullable":true,"description":"The name of the escalation policy."},"escalation_rules":{"type":"array","items":{"$ref":"#/components/schemas/IncidentResponseEscalationRule"},"nullable":true,"description":"The escalation rules for the escalation policy."},"src_url":{"type":"string","nullable":true,"description":"A deep-linked url to the escalation policy in a providers interface."},"teams":{"type":"array","items":{"$ref":"#/components/schemas/IncidentResponseTeamUnion"},"nullable":true,"description":"The teams that own the escalation policy."},"uid":{"$ref":"#/components/schemas/Id","description":"The unique identifier for the escalation policy."},"updated_time":{"type":"integer","nullable":true,"description":"A Unix timestamp in milliseconds representing the time the escalation policy was last updated."},"updated_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The human readable time the escalation policy was last updated."},"unmapped":{"$ref":"#/components/schemas/Object","nullable":true,"description":"The attributes that are not mapped to the incident response user schema. The names and values of those attributes are specific to each provider."}},"required":["uid"],"x-fern-availability":"in-development"}},"components/schemas/IncidentResponseQueryEscalationPolicyUsersOnCallResponse":{"id":"components/schemas/IncidentResponseQueryEscalationPolicyUsersOnCallResponse","kind":"json-schema","title":"IncidentResponseQueryEscalationPolicyUsersOnCallResponse","data":{"title":"IncidentResponseQueryEscalationPolicyUsersOnCallResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/IncidentResponseUserUnion"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}],"x-fern-availability":"in-development"}},"components/schemas/IncidentResponseQueryEscalationPoliciesResponse":{"id":"components/schemas/IncidentResponseQueryEscalationPoliciesResponse","kind":"json-schema","title":"IncidentResponseQueryEscalationPoliciesResponse","data":{"title":"IncidentResponseQueryEscalationPoliciesResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/IncidentResponseEscalationPolicy"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"in-development"}},"components/schemas/CreateIntegrationWebHookRequest":{"id":"components/schemas/CreateIntegrationWebHookRequest","kind":"json-schema","title":"CreateIntegrationWebHookRequest","data":{"title":"CreateIntegrationWebHookRequest","type":"object","properties":{"project":{"type":"string","description":"Project or Table to link the webhook."}},"required":["project"]}},"components/schemas/CreateIntegrationWebHookResponse":{"id":"components/schemas/CreateIntegrationWebHookResponse","kind":"json-schema","title":"CreateIntegrationWebHookResponse","data":{"title":"CreateIntegrationWebHookResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/IntegrationWebHook"}},"required":["result"]}},"components/schemas/ListIntegrationWebHooksResponse":{"id":"components/schemas/ListIntegrationWebHooksResponse","kind":"json-schema","title":"ListIntegrationWebHooksResponse","data":{"title":"ListIntegrationWebHooksResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/IntegrationWebHook"}},"url":{"type":"string","description":"Unique URL for this webhook. This is the URL that the end-user can use to manually create the webhook in the provider."}},"required":["result","url"]}},"components/schemas/IntegrationWebHookId":{"id":"components/schemas/IntegrationWebHookId","kind":"json-schema","title":"Id","data":{"title":"Id","type":"string"}},"components/schemas/IntegrationWebHook":{"id":"components/schemas/IntegrationWebHook","kind":"json-schema","title":"IntegrationWebHook","data":{"title":"IntegrationWebHook","type":"object","description":"Integration webhook","properties":{"id":{"$ref":"#/components/schemas/IntegrationWebHookId"},"creator":{"type":"string","description":"The user who created the webHook."},"enabled":{"type":"boolean","description":"Status of the WebHook."},"events":{"type":"array","items":{"type":"string"},"description":"List of events that trigger the WebHook."},"name":{"type":"string","description":"A name for the WebHook."},"value":{"type":"string","description":"The content of the webHook, this can be a URL or a specific code, it depends on the provider."},"created_at":{"type":"string","format":"date-time","description":"The date the WebHook was created."},"updated_at":{"type":"string","format":"date-time","nullable":true,"description":"The date the WebHook was last updated."},"unmapped":{"$ref":"#/components/schemas/Object","nullable":true,"description":"The attributes that are not mapped to the WebHook schema. The names and values of those attributes are specific to the provider."}},"required":["id","creator","enabled","events","name","value","created_at"]}},"components/schemas/TrafficLogConfiguration":{"id":"components/schemas/TrafficLogConfiguration","kind":"json-schema","title":"ocsfv1.8.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo","data":{"title":"ocsfv1.8.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo","type":"object","description":"Cloud Resources Inventory Info events report cloud asset inventory data. This data can be either logged or proactively collected. For example, use this event class when creating an inventory of cloud resource information from a Configuration Management Database (CMDB), Cyber Asset Attack Surface Management (CAASM), direct public cloud service provider APIs, Software-as-a-Service (SaaS) APIs, or otherwise.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.8.0Cloud","nullable":true,"description":"Cloud service provider or SaaS platform metadata about the cloud resource(s) that are being discovered by an inventory process."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"container":{"$ref":"#/components/schemas/ocsfv1.8.0Container","nullable":true,"description":"A cloud-based container image or running container discovered by an inventory process."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"database":{"$ref":"#/components/schemas/ocsfv1.8.0Database","nullable":true,"description":"A cloud-based database discovered by an inventory process."},"databucket":{"$ref":"#/components/schemas/ocsfv1.8.0Databucket","nullable":true,"description":"A cloud-based data bucket or other object storage discovered by an inventory process."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"idp":{"$ref":"#/components/schemas/ocsfv1.8.0Idp","nullable":true,"description":"The Identity Provider that is being discovered by an inventory process, or that is related to the cloud resource(s) being discovered by an inventory process."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"region":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cloud region where the resource is located, e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-isof-south-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"eastus2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-central1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", etc."},"children":[],"type":"text"}],"type":"paragraph"}]},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails"},"nullable":true,"description":"The cloud resource(s) that are being discovered by an inventory process. Use this object if there is not a direct object match in the class."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"table":{"$ref":"#/components/schemas/ocsfv1.8.0Table","nullable":true,"description":"A cloud-based database table discovered by an inventory process."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid"]}},"components/schemas/TrafficEvent":{"id":"components/schemas/TrafficEvent","kind":"json-schema","title":"ocsfv1.8.0networkactivityNetworkActivity","data":{"title":"ocsfv1.8.0networkactivityNetworkActivity","type":"object","description":"Network Activity events report network connection and traffic activity.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"app_name":{"type":"string","nullable":true,"description":"The network application name identified by tools such as NBAR or App ID (e.g., youtube, facebook, webex). This represents a specific network application that uses standard protocols (such as https or quic) to deliver its service."},"app_protocol_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The application-layer (Layer 7) protocol name identified by deep packet inspection or packet parsing (e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"quic"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ssh"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dns"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"), expressed as an IANA-registered service name from the IANA Service Name and Transport Protocol Port Number Registry."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" Port numbers alone are not always a reliable indicator of the actual application protocol in use."},"children":[],"type":"text"}],"type":"tag","tag":"html"}]},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Network Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"connection_info":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkConnectionInfo","nullable":true,"description":"The network connection information."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"cumulative_traffic":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkTraffic","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cumulative (running total) network traffic aggregated from the start of a flow or session. Use when reporting: (1) total accumulated bytes/packets since flow initiation, (2) combined aggregation models where both incremental deltas and running totals are reported together (populate both "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"traffic"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the delta and this attribute for the cumulative total), or (3) final summary metrics when a long-lived connection closes. This represents the sum of all activity from flow start to the current observation, not a delta or point-in-time value."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The responder of the network connection. In some contexts an event source cannot correctly identify the responder. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"is_src_dst_assignment_known"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for certainty."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"is_src_dst_assignment_known":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" denotes that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"src_endpoint"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dst_endpoint"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" correctly identify the initiator and responder respectively. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" denotes that the event source has arbitrarily assigned one peer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"src_endpoint"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and the other to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dst_endpoint"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", in other words that initiator and responder are not being asserted. This can occur, for example, when the event source is a network appliance that has not observed the initiation of a given connection. In the absence of this attribute, interpretation of the initiator and responder is implementation-specific."},"children":[],"type":"text"}],"type":"paragraph"}]},"ja4_fingerprint_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Ja4Fingerprint"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of the JA4+ network fingerprints."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"network_observation_point":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network endpoint that observes or inspects network traffic as a third-party system, used when the observer is neither the source nor the destination of the communication (when "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"observation_point_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" = 3). Examples include network taps, span ports, inline security devices, or packet capture systems that monitor traffic between other endpoints."},"children":[],"type":"text"}],"type":"paragraph"}]},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"observation_point":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity. The value is normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"observation_point_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"observation_point_id":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityObservationPointId","nullable":true,"description":"The normalized identifier of the observation point. The observation point identifier indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity."},"packet_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Packet"},"nullable":true,"description":"The list of packet objects describing captured network packets."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"proxy":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkProxy","nullable":true,"description":"The proxy (server) in a network connection."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The initiator of the network connection. In some contexts an event source cannot correctly identify the initiator. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"is_src_dst_assignment_known"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for certainty."},"children":[],"type":"text"}],"type":"paragraph"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"tls":{"$ref":"#/components/schemas/ocsfv1.8.0Tls","nullable":true,"description":"The Transport Layer Security (TLS) attributes."},"traffic":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkTraffic","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network traffic for this observation period. Use when reporting: (1) delta values (bytes/packets transferred since the last observation), (2) instantaneous measurements at a specific point in time, or (3) standalone single-event metrics. This attribute represents a point-in-time measurement or incremental change, not a running total. For accumulated totals across multiple observations or the lifetime of a flow, use "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cumulative_traffic"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" instead."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"url":{"$ref":"#/components/schemas/ocsfv1.8.0Url","nullable":true,"description":"The URL details relevant to the network traffic."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid"]}},"components/schemas/DNSLogConfiguration":{"id":"components/schemas/DNSLogConfiguration","kind":"json-schema","title":"ocsfv1.8.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo","data":{"title":"ocsfv1.8.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo","type":"object","description":"Cloud Resources Inventory Info events report cloud asset inventory data. This data can be either logged or proactively collected. For example, use this event class when creating an inventory of cloud resource information from a Configuration Management Database (CMDB), Cyber Asset Attack Surface Management (CAASM), direct public cloud service provider APIs, Software-as-a-Service (SaaS) APIs, or otherwise.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.8.0Cloud","nullable":true,"description":"Cloud service provider or SaaS platform metadata about the cloud resource(s) that are being discovered by an inventory process."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"container":{"$ref":"#/components/schemas/ocsfv1.8.0Container","nullable":true,"description":"A cloud-based container image or running container discovered by an inventory process."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"database":{"$ref":"#/components/schemas/ocsfv1.8.0Database","nullable":true,"description":"A cloud-based database discovered by an inventory process."},"databucket":{"$ref":"#/components/schemas/ocsfv1.8.0Databucket","nullable":true,"description":"A cloud-based data bucket or other object storage discovered by an inventory process."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"idp":{"$ref":"#/components/schemas/ocsfv1.8.0Idp","nullable":true,"description":"The Identity Provider that is being discovered by an inventory process, or that is related to the cloud resource(s) being discovered by an inventory process."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"region":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cloud region where the resource is located, e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-isof-south-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"eastus2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-central1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", etc."},"children":[],"type":"text"}],"type":"paragraph"}]},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails"},"nullable":true,"description":"The cloud resource(s) that are being discovered by an inventory process. Use this object if there is not a direct object match in the class."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"table":{"$ref":"#/components/schemas/ocsfv1.8.0Table","nullable":true,"description":"A cloud-based database table discovered by an inventory process."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid"]}},"components/schemas/DNSEvent":{"id":"components/schemas/DNSEvent","kind":"json-schema","title":"ocsfv1.8.0dnsactivityDnsActivity","data":{"title":"ocsfv1.8.0dnsactivityDnsActivity","type":"object","description":"DNS Activity events report DNS queries and answers as seen on the network.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"answers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0DnsAnswer"},"nullable":true,"description":"The Domain Name System (DNS) answers."},"app_name":{"type":"string","nullable":true,"description":"The network application name identified by tools such as NBAR or App ID (e.g., youtube, facebook, webex). This represents a specific network application that uses standard protocols (such as https or quic) to deliver its service."},"app_protocol_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The application-layer (Layer 7) protocol name identified by deep packet inspection or packet parsing (e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"quic"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ssh"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dns"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"), expressed as an IANA-registered service name from the IANA Service Name and Transport Protocol Port Number Registry."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" Port numbers alone are not always a reliable indicator of the actual application protocol in use."},"children":[],"type":"text"}],"type":"tag","tag":"html"}]},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Network Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"connection_info":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkConnectionInfo","nullable":true,"description":"The network connection information."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"cumulative_traffic":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkTraffic","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cumulative (running total) network traffic aggregated from the start of a flow or session. Use when reporting: (1) total accumulated bytes/packets since flow initiation, (2) combined aggregation models where both incremental deltas and running totals are reported together (populate both "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"traffic"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the delta and this attribute for the cumulative total), or (3) final summary metrics when a long-lived connection closes. This represents the sum of all activity from flow start to the current observation, not a delta or point-in-time value."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint","nullable":true,"description":"The responder (server) in a network connection."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"ja4_fingerprint_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Ja4Fingerprint"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of the JA4+ network fingerprints."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"network_observation_point":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network endpoint that observes or inspects network traffic as a third-party system, used when the observer is neither the source nor the destination of the communication (when "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"observation_point_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" = 3). Examples include network taps, span ports, inline security devices, or packet capture systems that monitor traffic between other endpoints."},"children":[],"type":"text"}],"type":"paragraph"}]},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"observation_point":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity. The value is normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"observation_point_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"observation_point_id":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityObservationPointId","nullable":true,"description":"The normalized identifier of the observation point. The observation point identifier indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity."},"packet_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Packet"},"nullable":true,"description":"The list of packet objects describing captured network packets."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"proxy":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkProxy","nullable":true,"description":"The proxy (server) in a network connection."},"query":{"$ref":"#/components/schemas/ocsfv1.8.0DnsQuery","nullable":true,"description":"The Domain Name System (DNS) query."},"query_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The Domain Name System (DNS) query time."},"query_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The Domain Name System (DNS) query time."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"rcode":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The DNS server response code, normalized to the caption of the rcode_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"rcode_id":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityRcodeId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized identifier of the DNS server response code. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc6895"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-6895"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"response_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The Domain Name System (DNS) response time."},"response_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The Domain Name System (DNS) response time."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint","nullable":true,"description":"The initiator (client) of the network connection."},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"tls":{"$ref":"#/components/schemas/ocsfv1.8.0Tls","nullable":true,"description":"The Transport Layer Security (TLS) attributes."},"traffic":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkTraffic","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network traffic for this observation period. Use when reporting: (1) delta values (bytes/packets transferred since the last observation), (2) instantaneous measurements at a specific point in time, or (3) standalone single-event metrics. This attribute represents a point-in-time measurement or incremental change, not a running total. For accumulated totals across multiple observations or the lifetime of a flow, use "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cumulative_traffic"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" instead."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid"]}},"components/schemas/FirewallRuleRecord":{"id":"components/schemas/FirewallRuleRecord","kind":"json-schema","title":"ocsfv1.8.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo","data":{"title":"ocsfv1.8.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo","type":"object","description":"Cloud Resources Inventory Info events report cloud asset inventory data. This data can be either logged or proactively collected. For example, use this event class when creating an inventory of cloud resource information from a Configuration Management Database (CMDB), Cyber Asset Attack Surface Management (CAASM), direct public cloud service provider APIs, Software-as-a-Service (SaaS) APIs, or otherwise.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.8.0Cloud","nullable":true,"description":"Cloud service provider or SaaS platform metadata about the cloud resource(s) that are being discovered by an inventory process."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"container":{"$ref":"#/components/schemas/ocsfv1.8.0Container","nullable":true,"description":"A cloud-based container image or running container discovered by an inventory process."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"database":{"$ref":"#/components/schemas/ocsfv1.8.0Database","nullable":true,"description":"A cloud-based database discovered by an inventory process."},"databucket":{"$ref":"#/components/schemas/ocsfv1.8.0Databucket","nullable":true,"description":"A cloud-based data bucket or other object storage discovered by an inventory process."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"idp":{"$ref":"#/components/schemas/ocsfv1.8.0Idp","nullable":true,"description":"The Identity Provider that is being discovered by an inventory process, or that is related to the cloud resource(s) being discovered by an inventory process."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"region":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cloud region where the resource is located, e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-isof-south-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"eastus2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-central1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", etc."},"children":[],"type":"text"}],"type":"paragraph"}]},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails"},"nullable":true,"description":"The cloud resource(s) that are being discovered by an inventory process. Use this object if there is not a direct object match in the class."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"table":{"$ref":"#/components/schemas/ocsfv1.8.0Table","nullable":true,"description":"A cloud-based database table discovered by an inventory process."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid"]}},"components/schemas/QueryTrafficLogConfigurationsResponse":{"id":"components/schemas/QueryTrafficLogConfigurationsResponse","kind":"json-schema","title":"QueryTrafficLogConfigurationsResponse","data":{"title":"QueryTrafficLogConfigurationsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/TrafficLogConfiguration"},"description":"List of traffic log configurations matching the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"in-development"}},"components/schemas/QueryTrafficEventsResponse":{"id":"components/schemas/QueryTrafficEventsResponse","kind":"json-schema","title":"QueryTrafficEventsResponse","data":{"title":"QueryTrafficEventsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/TrafficEvent"},"description":"List of traffic events matching the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"in-development"}},"components/schemas/QueryDNSLogConfigurationsResponse":{"id":"components/schemas/QueryDNSLogConfigurationsResponse","kind":"json-schema","title":"QueryDNSLogConfigurationsResponse","data":{"title":"QueryDNSLogConfigurationsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/DNSLogConfiguration"},"description":"List of DNS log configurations matching the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"in-development"}},"components/schemas/QueryDNSEventsResponse":{"id":"components/schemas/QueryDNSEventsResponse","kind":"json-schema","title":"QueryDNSEventsResponse","data":{"title":"QueryDNSEventsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/DNSEvent"},"description":"List of DNS events matching the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"in-development"}},"components/schemas/QueryFirewallRulesResponse":{"id":"components/schemas/QueryFirewallRulesResponse","kind":"json-schema","title":"QueryFirewallRulesResponse","data":{"title":"QueryFirewallRulesResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/FirewallRuleRecord"},"description":"List of firewall rules matching the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"in-development"}},"components/schemas/NotificationId":{"id":"components/schemas/NotificationId","kind":"json-schema","title":"Id","data":{"title":"Id","type":"string"}},"components/schemas/NotificationStatus":{"id":"components/schemas/NotificationStatus","kind":"json-schema","title":"NotificationStatus","data":{"title":"NotificationStatus","type":"string","enum":["OPEN","CLOSED"]}},"components/schemas/Notification":{"id":"components/schemas/Notification","kind":"json-schema","title":"Notification","data":{"title":"Notification","type":"object","description":"Notification object","properties":{"id":{"$ref":"#/components/schemas/NotificationId"},"summary":{"type":"string","description":"Notification summary."},"priority":{"$ref":"#/components/schemas/Priority","nullable":true,"description":"Notification priority"},"notification_status":{"$ref":"#/components/schemas/NotificationStatus","nullable":true,"description":"Notification status"},"project":{"type":"string","nullable":true,"description":"Notification project"},"status":{"type":"string","nullable":true,"description":"The current status of the notification."},"description":{"type":"string","nullable":true,"description":"Notification description."},"issue_type":{"type":"string","nullable":true,"description":"The notification's type."},"creator":{"type":"string","nullable":true,"description":"The user who created this notification."},"assignee":{"type":"string","nullable":true,"description":"Who notification is assigned to."},"contact":{"type":"string","nullable":true,"description":"The notification contact information."},"tags":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Associate tags with Notification"}},"required":["id","summary"],"allOf":[{"$ref":"#/components/schemas/Base"}]}},"components/schemas/CreateNotificationRequest":{"id":"components/schemas/CreateNotificationRequest","kind":"json-schema","title":"CreateNotificationRequest","data":{"title":"CreateNotificationRequest","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notification object. With some providers (Slack, Teams), if only the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"summary"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field is populated, the message will be treated as a \"passthrough notification\". In such cases, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"summary"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field will be used as the entire message, and no further formatting will be applied. This is useful if you need to include provider-specific formatting."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":"This field is deprecated and no longer used.","x-fern-availability":"deprecated"},"summary":{"type":"string","description":"Notification summary."},"priority":{"$ref":"#/components/schemas/Priority","nullable":true,"description":"Notification priority"},"project":{"type":"string","nullable":true,"description":"Notification project"},"status":{"type":"string","nullable":true,"description":"The current status of the notification."},"description":{"type":"string","nullable":true,"description":"Notification description."},"issue_type":{"type":"string","nullable":true,"description":"The notification's type."},"creator":{"type":"string","nullable":true,"description":"The user who created this notification."},"assignee":{"type":"string","nullable":true,"description":"Who notification is assigned to."},"contact":{"type":"string","nullable":true,"description":"The notification contact information."},"tags":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Associate tags with Notification"}},"required":["summary"]}},"components/schemas/CreateNotificationResponse":{"id":"components/schemas/CreateNotificationResponse","kind":"json-schema","title":"CreateNotificationResponse","data":{"title":"CreateNotificationResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/Notification"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/GetNotificationResponse":{"id":"components/schemas/GetNotificationResponse","kind":"json-schema","title":"GetNotificationResponse","data":{"title":"GetNotificationResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/Notification"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/ocsflatestApplicationSecurityPostureFinding":{"id":"components/schemas/ocsflatestApplicationSecurityPostureFinding","kind":"json-schema","title":"ocsfv1.8.0applicationsecurityposturefindingApplicationSecurityPostureFinding","data":{"title":"ocsfv1.8.0applicationsecurityposturefindingApplicationSecurityPostureFinding","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Application Security Posture Finding event is a notification about any bug, defect, deficiency, exploit, vulnerability, weakness or any other issue with software and related systems. Application Security Posture Findings typically involve reporting on the greater context including compliance, impacted resources, remediation guidance, specific code defects, and/or vulnerability metadata. Application Security Posture Findings can be reported by Threat & Vulnerability Management (TVM) tools, Application Security Posture Management (ASPM) tools, or other similar tools. Note: if the event producer is a security control, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile should be applied and its "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"attacks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" information, if present, should be duplicated into the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note: "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the Finding is an incident, i.e. requires incident workflow, also apply the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"incident"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile or aggregate this finding into an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Incident Finding"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingActivityId","description":"The normalized identifier of the finding activity."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The finding activity name, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"application":{"$ref":"#/components/schemas/ocsfv1.8.0Application","nullable":true,"description":"An Application describes the details for an inventoried application as reported by an Application Security tool or other Developer-centric tooling. Applications can be defined as Kubernetes resources, Containerized resources, or application hosting-specific cloud sources such as AWS Elastic BeanStalk, AWS Lightsail, or Azure Logic Apps."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"comment":{"type":"string","nullable":true,"description":"A user provided comment about the finding."},"compliance":{"$ref":"#/components/schemas/ocsfv1.8.0Compliance","nullable":true,"description":"Provides compliance context to vulnerabilities and other weaknesses that are reported as part of an Application Security or Vulnerability Management tool's built-in compliance framework mapping."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"device":{"$ref":"#/components/schemas/ocsfv1.8.0Device","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the affected device/host. If applicable, it can be used in conjunction with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Resource(s)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. Specific details about an AWS EC2 instance, that is affected by the Finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the most recent event included in the finding."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the most recent event included in the finding."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"finding_info":{"$ref":"#/components/schemas/ocsfv1.8.0FindingInfo","description":"Describes the supporting information about a generated finding."},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"remediation":{"$ref":"#/components/schemas/ocsfv1.8.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified vulnerabilities or weaknesses."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails"},"nullable":true,"description":"Describes details about the resource/resources that are affected by the vulnerability/vulnerabilities."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the least recent event included in the finding."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the least recent event included in the finding."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingStatusId","nullable":true,"description":"The normalized status identifier of the Finding, set by the consumer."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"vendor_attributes":{"$ref":"#/components/schemas/ocsfv1.8.0VendorAttributes","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability."},"children":[],"type":"text"}],"type":"paragraph"}]},"vulnerabilities":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Vulnerability"},"nullable":true,"description":"This object describes vulnerabilities reported in a security finding."}},"required":["activity_id","category_uid","class_uid","finding_info","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsflatestCloudResourcesInventoryInfo":{"id":"components/schemas/ocsflatestCloudResourcesInventoryInfo","kind":"json-schema","title":"ocsfv1.4.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo","data":{"title":"ocsfv1.4.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo","type":"object","description":"Cloud Resources Inventory Info events report cloud asset inventory data that is either logged or proactively collected. For example, use this event class when creating an inventory of cloud resource information from a Configuration Management Database (CMDB), Cyber Asset Attack Surface Management (CAASM), direct public cloud service provider APIs, Software-as-a-Service (SaaS) APIs, or otherwise.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.4.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign."},"api":{"$ref":"#/components/schemas/ocsfv1.4.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects describing identified tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.4.0Cloud","nullable":true,"description":"Cloud service provider or SaaS platform metadata about the cloud resource(s) that are being discovered by an inventory process."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"container":{"$ref":"#/components/schemas/ocsfv1.4.0Container","nullable":true,"description":"A cloud-based container image or running container discovered by an inventory process."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.4.0Object","nullable":true,"description":"A list of custom fields"},"database":{"$ref":"#/components/schemas/ocsfv1.4.0Database","nullable":true,"description":"A cloud-based database discovered by an inventory process."},"databucket":{"$ref":"#/components/schemas/ocsfv1.4.0Databucket","nullable":true,"description":"A cloud-based data bucket or other object storage discovered by an inventory process."},"device":{"$ref":"#/components/schemas/ocsfv1.4.0Device","nullable":true,"description":"An addressable device, computer system or host."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.4.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"idp":{"$ref":"#/components/schemas/ocsfv1.4.0Idp","nullable":true,"description":"The Identity Provider that is being discovered by an inventory process, or that is related to the cloud resource(s) being discovered by an inventory process."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.4.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"policy":{"$ref":"#/components/schemas/ocsfv1.4.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"region":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cloud region where the resource is located, e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-isof-south-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"eastus2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-central1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", etc."},"children":[],"type":"text"}],"type":"paragraph"}]},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0ResourceDetails"},"nullable":true,"description":"The cloud resource(s) that are being discovered by an inventory process. Use this object if there is not a direct object match in the class."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"table":{"$ref":"#/components/schemas/ocsfv1.4.0Table","nullable":true,"description":"A cloud-based database table discovered by an inventory process."},"time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.4.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsflatestComplianceFinding":{"id":"components/schemas/ocsflatestComplianceFinding","kind":"json-schema","title":"ocsfv1.3.0compliancefindingComplianceFinding","data":{"title":"ocsfv1.3.0compliancefindingComplianceFinding","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Compliance Finding events describe results of evaluations performed against resources, to check compliance with various Industry Frameworks or Security Standards such as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST SP 800-53, CIS AWS Foundations Benchmark v1.4.0, ISO/IEC 27001"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" etc."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingActivityId","description":"The normalized identifier of the finding activity."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The finding activity name, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"comment":{"type":"string","nullable":true,"description":"A user provided comment about the finding."},"compliance":{"$ref":"#/components/schemas/ocsfv1.3.0Compliance","description":"The compliance object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS, NIST etc.) and contains compliance related details."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the affected device/host. It can be used in conjunction with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Affected Resource(s)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. Specific details about an AWS EC2 instance, that is affected by the Finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time of the most recent event included in the finding."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the most recent event included in the finding."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"finding_info":{"$ref":"#/components/schemas/ocsfv1.3.0FindingInfo","description":"Describes the supporting information about a generated finding."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"remediation":{"$ref":"#/components/schemas/ocsfv1.3.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"resource":{"$ref":"#/components/schemas/ocsfv1.3.0ResourceDetails","nullable":true,"description":"Describes details about the resource that is the subject of the compliance check."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0ResourceDetails"},"nullable":true,"description":"Describes details about the resource/resouces that are the subject of the compliance check."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time of the least recent event included in the finding."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the least recent event included in the finding."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingStatusId","nullable":true,"description":"The normalized status identifier of the Finding, set by the consumer."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","compliance","finding_info","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsflatestDetectionFinding":{"id":"components/schemas/ocsflatestDetectionFinding","kind":"json-schema","title":"ocsfv1.3.0detectionfindingDetectionFinding","data":{"title":"ocsfv1.3.0detectionfindingDetectionFinding","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the product is a security control, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile should be applied and its "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"attacks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" information should be duplicated into the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. Dispositions conform to an action of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed' or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Denied' in most cases. Note that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"99"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Other' is not an option. No action would equate to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingActivityId","description":"The normalized identifier of the finding activity."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The finding activity name, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects describing the tactics, techniques & sub-techniques identified by a security control or finding."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"comment":{"type":"string","nullable":true,"description":"A user provided comment about the finding."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the affected device/host. It can be used in conjunction with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Affected Resource(s)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. Specific details about an AWS EC2 instance, that is affected by the Finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time of the most recent event included in the finding."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the most recent event included in the finding."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"evidences":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Evidences"},"nullable":true,"description":"Describes various evidence artifacts associated to the activity/activities that triggered a security detection."},"finding_info":{"$ref":"#/components/schemas/ocsfv1.3.0FindingInfo","description":"Describes the supporting information about a generated finding."},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.3.0FirewallRule","nullable":true,"description":"The firewall rule that triggered the event."},"impact":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"impact_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingImpactId","nullable":true,"description":"The normalized impact of the finding."},"impact_score":{"type":"integer","nullable":true,"description":"The impact of the finding, valid range 0-100."},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"remediation":{"$ref":"#/components/schemas/ocsfv1.3.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0ResourceDetails"},"nullable":true,"description":"Describes details about resources that were the target of the activity that triggered the finding."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time of the least recent event included in the finding."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the least recent event included in the finding."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingStatusId","nullable":true,"description":"The normalized status identifier of the Finding, set by the consumer."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"vulnerabilities":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Vulnerability"},"nullable":true,"description":"Describes vulnerabilities reported in a Detection Finding."}},"required":["activity_id","category_uid","class_uid","finding_info","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsflatestEntityManagement":{"id":"components/schemas/ocsflatestEntityManagement","kind":"json-schema","title":"ocsfv1.3.0entitymanagementEntityManagement","data":{"title":"ocsfv1.3.0entitymanagementEntityManagement","type":"object","description":"Entity Management events report activity by a managed client, a micro service, or a user at a management console. The activity can be a create, read, update, and delete operation on a managed entity.","properties":{"access_list":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of requested access rights."},"access_mask":{"type":"integer","nullable":true,"description":"The access mask in a platform-native format."},"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0entitymanagementActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"Used for when the entity acting upon another entity is a process or user."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Identity & Access Management"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0entitymanagementCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0entitymanagementClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"comment":{"type":"string","nullable":true,"description":"The user provided comment about why the entity was changed."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"An addressable device, computer system or host."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"entity":{"$ref":"#/components/schemas/ocsfv1.3.0ManagedEntity","description":"The managed entity that is being acted upon."},"entity_result":{"$ref":"#/components/schemas/ocsfv1.3.0ManagedEntity","nullable":true,"description":"The updated managed entity."},"http_request":{"$ref":"#/components/schemas/ocsfv1.3.0HttpRequest","nullable":true,"description":"Details about the underlying HTTP request."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0entitymanagementSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"Details about the source of the IAM activity."},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0entitymanagementStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0entitymanagementTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","entity","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsflatestApplicationInventoryInfo":{"id":"components/schemas/ocsflatestApplicationInventoryInfo","kind":"json-schema","title":"ocsfv1.8.0applicationinventoryinfoApplicationInventoryInfo","data":{"title":"ocsfv1.8.0applicationinventoryinfoApplicationInventoryInfo","type":"object","description":"Application Inventory Info events report application inventory information that is either logged or proactively collected. For example, when collecting application information from a CMDB, running a network sweep of connected applications, or when scanning an application with a application security tool.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"application":{"$ref":"#/components/schemas/ocsfv1.8.0Application","description":"The application that was discovered."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0applicationinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0applicationinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"criticality":{"type":"string","nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.criticality attribute instead."},"data":{"nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.data attribute instead."},"desc":{"type":"string","nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.desc attribute instead."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"group":{"$ref":"#/components/schemas/ocsfv1.8.0Group","nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.group attribute instead."},"hostname":{"$ref":"#/components/schemas/ocsfv1.8.0Hostname","nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.hostname attribute instead."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"name":{"type":"string","nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.name attribute instead."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"owner":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.owner attribute instead."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This field is deprecated and will be removed in a future sdk version. Use the application.risk_level attribute instead."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationinventoryinfoRiskLevelId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This field is deprecated and will be removed in a future sdk version. Use the application.risk_level_id attribute instead."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_score":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This field is deprecated and will be removed in a future sdk version. Use the application.risk_score attribute instead."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KeyValueObject"},"nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.tags attribute instead."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the application creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the application creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.type attribute instead."},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0applicationinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.uid attribute instead."},"uid_alt":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This field is deprecated and will be removed in a future sdk version. Use the application.uid_alt attribute instead."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"url":{"$ref":"#/components/schemas/ocsfv1.8.0Url","nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.url attribute instead."}},"required":["activity_id","application","category_uid","class_uid","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsflatestAccessGrantInventoryInfo":{"id":"components/schemas/ocsflatestAccessGrantInventoryInfo","kind":"json-schema","title":"ocsfv1.8.0accessgrantinventoryinfoAccessGrantInventoryInfo","data":{"title":"ocsfv1.8.0accessgrantinventoryinfoAccessGrantInventoryInfo","type":"object","description":"Access Grant Inventory Info events report access grant inventory data that is either logged or proactively collected. An access grant is standing access held by a principal, such as permissions or scopes granted to an application, or a principal assigned to an application or resource. Each event reports one grant. For example, when listing the OAuth consent grants and application role assignments in an identity provider tenant.","properties":{"access_grant":{"$ref":"#/components/schemas/ocsfv1.8.0AccessGrant","description":"The access grant that was discovered."},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0accessgrantinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.8.0Actor","nullable":true,"description":"The actor describes the process or service that collected the access grant inventory."},"application":{"$ref":"#/components/schemas/ocsfv1.8.0Application","nullable":true,"description":"The client application that exercises the grant. For a delegated permission, the application acting on behalf of the principal; for an application permission, the application that is also the principal."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0accessgrantinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0accessgrantinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"principal":{"$ref":"#/components/schemas/ocsfv1.8.0Principal","description":"The security principal that holds the grant."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0accessgrantinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0accessgrantinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time, or the time when the inventory was collected."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time, or the time when the inventory was collected."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0accessgrantinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["access_grant","activity_id","category_uid","class_uid","metadata","principal","severity_id","time","type_uid"]}},"components/schemas/ocsflatestScanActivity":{"id":"components/schemas/ocsflatestScanActivity","kind":"json-schema","title":"ocsfv1.8.0scanactivityScanActivity","data":{"title":"ocsfv1.8.0scanactivityScanActivity","type":"object","description":"Scan events report the start, completion, and results of a scan job. The scan event includes the number of items that were scanned and the number of detections that were resolved.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.8.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Application Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"command_uid":{"type":"string","nullable":true,"description":"The command identifier that is associated with this scan event.  This ID uniquely identifies the proactive scan command, e.g., if remotely initiated."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivityConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"device":{"$ref":"#/components/schemas/ocsfv1.8.0Device","nullable":true,"description":"An addressable device, computer system or host."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":"The duration of the scan"},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of the scan job."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of the scan job."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"num_detections":{"type":"integer","nullable":true,"description":"The number of detections."},"num_files":{"type":"integer","nullable":true,"description":"The number of files scanned."},"num_folders":{"type":"integer","nullable":true,"description":"The number of folders scanned."},"num_network_items":{"type":"integer","nullable":true,"description":"The number of network items scanned."},"num_processes":{"type":"integer","nullable":true,"description":"The number of processes scanned."},"num_registry_items":{"type":"integer","nullable":true,"description":"The number of registry items scanned."},"num_resolutions":{"type":"integer","nullable":true,"description":"The number of items that were resolved."},"num_skipped_items":{"type":"integer","nullable":true,"description":"The number of skipped items."},"num_trusted_items":{"type":"integer","nullable":true,"description":"The number of trusted items."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy associated with this Scan event; required if the scan was initiated by a policy."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivityRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"scan":{"$ref":"#/components/schemas/ocsfv1.8.0Scan","description":"The Scan object describes characteristics of the scan job."},"schedule_uid":{"type":"string","nullable":true,"description":"The unique identifier of the schedule associated with a scan job."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of the scan job."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of the scan job."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"total":{"type":"integer","nullable":true,"description":"The total number of items that were scanned; zero if no items were scanned."},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","scan","severity_id","time","type_uid"]}},"components/schemas/ocsflatestUserInventoryInfo":{"id":"components/schemas/ocsflatestUserInventoryInfo","kind":"json-schema","title":"ocsfv1.8.0userinventoryUserInventory","data":{"title":"ocsfv1.8.0userinventoryUserInventory","type":"object","description":"User Inventory Info events report user inventory data that is either logged or proactively collected. For example, when collecting user information from Active Directory entries.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0userinventoryActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.8.0Actor","nullable":true,"description":"The actor describes the process that was the source of the inventory activity. In the case of user inventory data, that could be a particular process or script that is run to scrape the user data. For example, it could be a powershell process that runs to pull data from the Azure AD graph API."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0userinventoryCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0userinventoryClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0userinventorySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0userinventoryStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0userinventoryTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"user":{"$ref":"#/components/schemas/ocsfv1.8.0User","description":"The user that is being discovered by an inventory process."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid","user"]}},"components/schemas/ocsflatestTrainingCampaignInventoryInfo":{"id":"components/schemas/ocsflatestTrainingCampaignInventoryInfo","kind":"json-schema","title":"ocsfv1.8.0trainingcampaigninventoryinfoTrainingCampaignInventoryInfo","data":{"title":"ocsfv1.8.0trainingcampaigninventoryinfoTrainingCampaignInventoryInfo","type":"object","description":"Training Campaign Inventory Info events report security awareness training campaign inventory from security awareness training products. These events describe training campaigns, assignments, or learning program instances that are either logged or proactively collected.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the training campaign's creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the training campaign's creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"training_campaign":{"$ref":"#/components/schemas/ocsfv1.8.0TrainingCampaign","description":"The security awareness training campaign that was discovered."},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","training_campaign","type_uid"]}},"components/schemas/ocsflatestPhishingSimulationInventoryInfo":{"id":"components/schemas/ocsflatestPhishingSimulationInventoryInfo","kind":"json-schema","title":"ocsfv1.8.0phishingsimulationinventoryinfoPhishingSimulationInventoryInfo","data":{"title":"ocsfv1.8.0phishingsimulationinventoryinfoPhishingSimulationInventoryInfo","type":"object","description":"Phishing Simulation Inventory Info events report phishing program, simulation run, and/or template inventory data that is either logged or proactively collected from a security awareness training platform. These events describe security awareness-testing programs, campaigns, or campaign runs that are either logged or proactively collected, not malicious threat-actor campaigns.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"phishing_program":{"$ref":"#/components/schemas/ocsfv1.8.0PhishingProgram","nullable":true,"description":"The phishing program that the phishing simulation belongs to."},"phishing_simulation":{"$ref":"#/components/schemas/ocsfv1.8.0PhishingSimulation","description":"The simulated phishing simulation that was discovered."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the phishing simulation's creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the phishing simulation's creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","phishing_simulation","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0accountchangeAccountChange":{"id":"components/schemas/ocsfv1.3.0accountchangeAccountChange","kind":"json-schema","title":"ocsfv1.3.0accountchangeAccountChange","data":{"title":"ocsfv1.3.0accountchangeAccountChange","type":"object","description":"Account Change events report when specific user account management tasks are performed, such as a user/role being created, changed, deleted, renamed, disabled, enabled, locked out or unlocked.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0accountchangeActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Identity & Access Management"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0accountchangeCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0accountchangeClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"An addressable device, computer system or host."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"http_request":{"$ref":"#/components/schemas/ocsfv1.3.0HttpRequest","nullable":true,"description":"Details about the underlying HTTP request."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"policy":{"$ref":"#/components/schemas/ocsfv1.3.0Policy","nullable":true,"description":"Details about the IAM policy associated to the Attach/Detach Policy activities."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0accountchangeSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"Details about the source of the IAM activity."},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0accountchangeStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0accountchangeTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"user":{"$ref":"#/components/schemas/ocsfv1.3.0User","description":"The user that was a target of an activity."},"user_result":{"$ref":"#/components/schemas/ocsfv1.3.0User","nullable":true,"description":"The result of the user account change. It should contain the new values of the changed attributes."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid","user"]}},"components/schemas/ocsfv1.3.0accountchangeActivityId":{"id":"components/schemas/ocsfv1.3.0accountchangeActivityId","kind":"json-schema","title":"ocsfv1.3.0accountchangeActivityId","data":{"title":"ocsfv1.3.0accountchangeActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Create: A user/role was created."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Enable: A user/role was enabled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - PasswordChange: An attempt was made to change an account's password."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - PasswordReset: An attempt was made to reset an account's password."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Disable: A user/role was disabled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Delete: A user/role was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - AttachPolicy: An IAM Policy was attached to a user/role."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - DetachPolicy: An IAM Policy was detached from a user/role."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Lock: A user account was locked out."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - MFAFactorEnable: An authentication factor was enabled for an account."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - MFAFactorDisable: An authentication factor was disabled for an account."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0accountchangeCategoryUid":{"id":"components/schemas/ocsfv1.3.0accountchangeCategoryUid","kind":"json-schema","title":"ocsfv1.3.0accountchangeCategoryUid","data":{"title":"ocsfv1.3.0accountchangeCategoryUid","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CategoryUid is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - AccessManagement: Identity & Access Management (IAM) events relate to the supervision of the system's authentication and access control model. Examples of such events are the success or failure of authentication, granting of authority, password change, entity change, privileged use etc."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0accountchangeClassUid":{"id":"components/schemas/ocsfv1.3.0accountchangeClassUid","kind":"json-schema","title":"ocsfv1.3.0accountchangeClassUid","data":{"title":"ocsfv1.3.0accountchangeClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n3001 - AccountChange: Account Change events report when specific user account management tasks are performed, such as a user/role being created, changed, deleted, renamed, disabled, enabled, locked out or unlocked."}},"components/schemas/ocsfv1.3.0accountchangeSeverityId":{"id":"components/schemas/ocsfv1.3.0accountchangeSeverityId","kind":"json-schema","title":"ocsfv1.3.0accountchangeSeverityId","data":{"title":"ocsfv1.3.0accountchangeSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0accountchangeStatusId":{"id":"components/schemas/ocsfv1.3.0accountchangeStatusId","kind":"json-schema","title":"ocsfv1.3.0accountchangeStatusId","data":{"title":"ocsfv1.3.0accountchangeStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0accountchangeTypeUid":{"id":"components/schemas/ocsfv1.3.0accountchangeTypeUid","kind":"json-schema","title":"ocsfv1.3.0accountchangeTypeUid","data":{"title":"ocsfv1.3.0accountchangeTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n300100 - Unknown\n300101 - Create: A user/role was created.\n300102 - Enable: A user/role was enabled.\n300103 - PasswordChange: An attempt was made to change an account's password.\n300104 - PasswordReset: An attempt was made to reset an account's password.\n300105 - Disable: A user/role was disabled.\n300106 - Delete: A user/role was deleted.\n300107 - AttachPolicy: An IAM Policy was attached to a user/role.\n300108 - DetachPolicy: An IAM Policy was detached from a user/role.\n300109 - Lock: A user account was locked out.\n300110 - MFAFactorEnable: An authentication factor was enabled for an account.\n300111 - MFAFactorDisable: An authentication factor was disabled for an account.\n300199 - Other"}},"components/schemas/ocsfv1.3.0apiactivityActivityId":{"id":"components/schemas/ocsfv1.3.0apiactivityActivityId","kind":"json-schema","title":"ocsfv1.3.0apiactivityActivityId","data":{"title":"ocsfv1.3.0apiactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Create: The API call in the event pertains to a 'create' activity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Read: The API call in the event pertains to a 'read' activity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Update: The API call in the event pertains to a 'update' activity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Delete: The API call in the event pertains to a 'delete' activity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0apiactivityApiActivity":{"id":"components/schemas/ocsfv1.3.0apiactivityApiActivity","kind":"json-schema","title":"ocsfv1.3.0apiactivityApiActivity","data":{"title":"ocsfv1.3.0apiactivityApiActivity","type":"object","description":"API events describe general CRUD (Create, Read, Update, Delete) API activities, e.g. (AWS Cloudtrail)","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0apiactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Application Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0apiactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0apiactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"The network destination endpoint."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"http_request":{"$ref":"#/components/schemas/ocsfv1.3.0HttpRequest","nullable":true,"description":"Details about the underlying http request."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0ResourceDetails"},"nullable":true,"description":"Details about resources that were affected by the activity/event."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0apiactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","description":"Details about the source of the activity."},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0apiactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0apiactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","actor","category_uid","class_uid","metadata","severity_id","src_endpoint","time","type_uid"]}},"components/schemas/ocsfv1.3.0apiactivityCategoryUid":{"id":"components/schemas/ocsfv1.3.0apiactivityCategoryUid","kind":"json-schema","title":"ocsfv1.3.0apiactivityCategoryUid","data":{"title":"ocsfv1.3.0apiactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n6 - ApplicationActivity: Application Activity events report detailed information about the behavior of applications and services."}},"components/schemas/ocsfv1.3.0apiactivityClassUid":{"id":"components/schemas/ocsfv1.3.0apiactivityClassUid","kind":"json-schema","title":"ocsfv1.3.0apiactivityClassUid","data":{"title":"ocsfv1.3.0apiactivityClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n6003 - APIActivity: API events describe general CRUD (Create, Read, Update, Delete) API activities, e.g. (AWS Cloudtrail)"}},"components/schemas/ocsfv1.3.0apiactivitySeverityId":{"id":"components/schemas/ocsfv1.3.0apiactivitySeverityId","kind":"json-schema","title":"ocsfv1.3.0apiactivitySeverityId","data":{"title":"ocsfv1.3.0apiactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0apiactivityStatusId":{"id":"components/schemas/ocsfv1.3.0apiactivityStatusId","kind":"json-schema","title":"ocsfv1.3.0apiactivityStatusId","data":{"title":"ocsfv1.3.0apiactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0apiactivityTypeUid":{"id":"components/schemas/ocsfv1.3.0apiactivityTypeUid","kind":"json-schema","title":"ocsfv1.3.0apiactivityTypeUid","data":{"title":"ocsfv1.3.0apiactivityTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n600300 - Unknown\n600301 - Create: The API call in the event pertains to a 'create' activity.\n600302 - Read: The API call in the event pertains to a 'read' activity.\n600303 - Update: The API call in the event pertains to a 'update' activity.\n600304 - Delete: The API call in the event pertains to a 'delete' activity.\n600399 - Other"}},"components/schemas/ocsfv1.3.0applicationlifecycleActivityId":{"id":"components/schemas/ocsfv1.3.0applicationlifecycleActivityId","kind":"json-schema","title":"ocsfv1.3.0applicationlifecycleActivityId","data":{"title":"ocsfv1.3.0applicationlifecycleActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Install: Install the application."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Remove: Remove the application."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Start: Start the application."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Stop: Stop the application."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Restart: Restart the application."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Enable: Enable the application."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Disable: Disable the application."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Update: Update the application."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0applicationlifecycleApplicationLifecycle":{"id":"components/schemas/ocsfv1.3.0applicationlifecycleApplicationLifecycle","kind":"json-schema","title":"ocsfv1.3.0applicationlifecycleApplicationLifecycle","data":{"title":"ocsfv1.3.0applicationlifecycleApplicationLifecycle","type":"object","description":"Application Lifecycle events report installation, removal, start, stop of an application or service.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0applicationlifecycleActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"app":{"$ref":"#/components/schemas/ocsfv1.3.0Product","description":"The application that was affected by the lifecycle event.  This also applies to self-updating application systems."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Application Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0applicationlifecycleCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0applicationlifecycleClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"An addressable device, computer system or host."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0applicationlifecycleSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0applicationlifecycleStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0applicationlifecycleTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","app","category_uid","class_uid","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0applicationlifecycleCategoryUid":{"id":"components/schemas/ocsfv1.3.0applicationlifecycleCategoryUid","kind":"json-schema","title":"ocsfv1.3.0applicationlifecycleCategoryUid","data":{"title":"ocsfv1.3.0applicationlifecycleCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n6 - ApplicationActivity: Application Activity events report detailed information about the behavior of applications and services."}},"components/schemas/ocsfv1.3.0applicationlifecycleClassUid":{"id":"components/schemas/ocsfv1.3.0applicationlifecycleClassUid","kind":"json-schema","title":"ocsfv1.3.0applicationlifecycleClassUid","data":{"title":"ocsfv1.3.0applicationlifecycleClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n6002 - ApplicationLifecycle: Application Lifecycle events report installation, removal, start, stop of an application or service."}},"components/schemas/ocsfv1.3.0applicationlifecycleSeverityId":{"id":"components/schemas/ocsfv1.3.0applicationlifecycleSeverityId","kind":"json-schema","title":"ocsfv1.3.0applicationlifecycleSeverityId","data":{"title":"ocsfv1.3.0applicationlifecycleSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0applicationlifecycleStatusId":{"id":"components/schemas/ocsfv1.3.0applicationlifecycleStatusId","kind":"json-schema","title":"ocsfv1.3.0applicationlifecycleStatusId","data":{"title":"ocsfv1.3.0applicationlifecycleStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0applicationlifecycleTypeUid":{"id":"components/schemas/ocsfv1.3.0applicationlifecycleTypeUid","kind":"json-schema","title":"ocsfv1.3.0applicationlifecycleTypeUid","data":{"title":"ocsfv1.3.0applicationlifecycleTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n600200 - Unknown\n600201 - Install: Install the application.\n600202 - Remove: Remove the application.\n600203 - Start: Start the application.\n600204 - Stop: Stop the application.\n600205 - Restart: Restart the application.\n600206 - Enable: Enable the application.\n600207 - Disable: Disable the application.\n600208 - Update: Update the application.\n600299 - Other"}},"components/schemas/ocsfv1.3.0authenticationActivityId":{"id":"components/schemas/ocsfv1.3.0authenticationActivityId","kind":"json-schema","title":"ocsfv1.3.0authenticationActivityId","data":{"title":"ocsfv1.3.0authenticationActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Logon: A new logon session was requested."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Logoff: A logon session was terminated and no longer exists."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - AuthenticationTicket: A Kerberos authentication ticket (TGT) was requested."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - ServiceTicketRequest: A Kerberos service ticket was requested."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - ServiceTicketRenew: A Kerberos service ticket was renewed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Preauth: A preauthentication stage was engaged."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0authenticationAuthProtocolId":{"id":"components/schemas/ocsfv1.3.0authenticationAuthProtocolId","kind":"json-schema","title":"ocsfv1.3.0authenticationAuthProtocolId","data":{"title":"ocsfv1.3.0authenticationAuthProtocolId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AuthProtocolId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The authentication protocol is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - NTLM"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Kerberos"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Digest"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - OpenID"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - SAML"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - 0"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - PAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - CHAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - EAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - RADIUS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The authentication protocol is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"auth_protocol"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0authenticationAuthentication":{"id":"components/schemas/ocsfv1.3.0authenticationAuthentication","kind":"json-schema","title":"ocsfv1.3.0authenticationAuthentication","data":{"title":"ocsfv1.3.0authenticationAuthentication","type":"object","description":"Authentication events report authentication session activities such as user attempts a logon or logoff, successfully or otherwise.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0authenticationActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor that requested the authentication."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"auth_factors":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0AuthFactor"},"nullable":true,"description":"Describes a category of methods used for identity verification in an authentication attempt."},"auth_protocol":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The authentication protocol as defined by the caption of 'auth_protocol_id'. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"auth_protocol_id":{"$ref":"#/components/schemas/ocsfv1.3.0authenticationAuthProtocolId","nullable":true,"description":"The normalized identifier of the authentication protocol used to create the user session."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Identity & Access Management"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0authenticationCategoryUid","description":"The category unique identifier of the event."},"certificate":{"$ref":"#/components/schemas/ocsfv1.3.0Certificate","nullable":true,"description":"The certificate associated with the authentication or pre-authentication (Kerberos)."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0authenticationClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"An addressable device, computer system or host."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"The endpoint to which the authentication was targeted."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"http_request":{"$ref":"#/components/schemas/ocsfv1.3.0HttpRequest","nullable":true,"description":"Details about the underlying HTTP request."},"is_cleartext":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates whether the credentials were passed in clear text."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" True if the credentials were passed in a clear text protocol such as FTP or TELNET, or if Windows detected that a user's logon password was passed to the authentication package in clear text."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"is_mfa":{"type":"boolean","nullable":true,"description":"Indicates whether Multi Factor Authentication was used during authentication."},"is_new_logon":{"type":"boolean","nullable":true,"description":"Indicates logon is from a device not seen before or a first time account logon."},"is_remote":{"type":"boolean","nullable":true,"description":"The attempted authentication is over a remote connection."},"logon_process":{"$ref":"#/components/schemas/ocsfv1.3.0Process","nullable":true,"description":"The trusted process that validated the authentication credentials."},"logon_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The logon type, normalized to the caption of the logon_type_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"logon_type_id":{"$ref":"#/components/schemas/ocsfv1.3.0authenticationLogonTypeId","nullable":true,"description":"The normalized logon type identifier."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"service":{"$ref":"#/components/schemas/ocsfv1.3.0Service","nullable":true,"description":"The service or gateway to which the user or process is being authenticated"},"session":{"$ref":"#/components/schemas/ocsfv1.3.0Session","nullable":true,"description":"The authenticated user or service session."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0authenticationSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"Details about the source of the IAM activity."},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The details about the authentication request. For example, possible details for Windows logon or logoff events are:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Success"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LOGOFF_USER_INITIATED"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LOGOFF_OTHER"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Failure"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"USER_DOES_NOT_EXIST"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"INVALID_CREDENTIALS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ACCOUNT_DISABLED"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ACCOUNT_LOCKED_OUT"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"PASSWORD_EXPIRED"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0authenticationStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0authenticationTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"user":{"$ref":"#/components/schemas/ocsfv1.3.0User","description":"The subject (user/role or account) to authenticate."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid","user"]}},"components/schemas/ocsfv1.3.0authenticationCategoryUid":{"id":"components/schemas/ocsfv1.3.0authenticationCategoryUid","kind":"json-schema","title":"ocsfv1.3.0authenticationCategoryUid","data":{"title":"ocsfv1.3.0authenticationCategoryUid","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CategoryUid is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - AccessManagement: Identity & Access Management (IAM) events relate to the supervision of the system's authentication and access control model. Examples of such events are the success or failure of authentication, granting of authority, password change, entity change, privileged use etc."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0authenticationClassUid":{"id":"components/schemas/ocsfv1.3.0authenticationClassUid","kind":"json-schema","title":"ocsfv1.3.0authenticationClassUid","data":{"title":"ocsfv1.3.0authenticationClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n3002 - Authentication: Authentication events report authentication session activities such as user attempts a logon or logoff, successfully or otherwise."}},"components/schemas/ocsfv1.3.0authenticationLogonTypeId":{"id":"components/schemas/ocsfv1.3.0authenticationLogonTypeId","kind":"json-schema","title":"ocsfv1.3.0authenticationLogonTypeId","data":{"title":"ocsfv1.3.0authenticationLogonTypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LogonTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The logon type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - System: Used only by the System account, for example at system startup."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Interactive: A local logon to device console."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Network: A user or device logged onto this device from the network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Batch: A batch server logon, where processes may be executing on behalf of a user without their direct intervention."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - OSService: A logon by a service or daemon that was started by the OS."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Unlock: A user unlocked the device."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - NetworkCleartext: A user logged on to this device from the network. The user's password in the authentication package was not hashed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - NewCredentials: A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - RemoteInteractive: A remote logon using Terminal Services or remote desktop application."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - CachedInteractive: A user logged on to this device with network credentials that were stored locally on the device and the domain controller was not contacted to verify the credentials."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - CachedRemoteInteractive: Same as Remote Interactive. This is used for internal auditing."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - CachedUnlock: Workstation logon."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The logon type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"logon_type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0authenticationSeverityId":{"id":"components/schemas/ocsfv1.3.0authenticationSeverityId","kind":"json-schema","title":"ocsfv1.3.0authenticationSeverityId","data":{"title":"ocsfv1.3.0authenticationSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0authenticationStatusId":{"id":"components/schemas/ocsfv1.3.0authenticationStatusId","kind":"json-schema","title":"ocsfv1.3.0authenticationStatusId","data":{"title":"ocsfv1.3.0authenticationStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0authenticationTypeUid":{"id":"components/schemas/ocsfv1.3.0authenticationTypeUid","kind":"json-schema","title":"ocsfv1.3.0authenticationTypeUid","data":{"title":"ocsfv1.3.0authenticationTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n300200 - Unknown\n300201 - Logon: A new logon session was requested.\n300202 - Logoff: A logon session was terminated and no longer exists.\n300203 - AuthenticationTicket: A Kerberos authentication ticket (TGT) was requested.\n300204 - ServiceTicketRequest: A Kerberos service ticket was requested.\n300205 - ServiceTicketRenew: A Kerberos service ticket was renewed.\n300206 - Preauth: A preauthentication stage was engaged.\n300299 - Other"}},"components/schemas/ocsfv1.3.0authorizesessionActivityId":{"id":"components/schemas/ocsfv1.3.0authorizesessionActivityId","kind":"json-schema","title":"ocsfv1.3.0authorizesessionActivityId","data":{"title":"ocsfv1.3.0authorizesessionActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - AssignPrivileges: Assign special privileges to a new logon."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - AssignGroups: Assign special groups to a new logon."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0authorizesessionAuthorizeSession":{"id":"components/schemas/ocsfv1.3.0authorizesessionAuthorizeSession","kind":"json-schema","title":"ocsfv1.3.0authorizesessionAuthorizeSession","data":{"title":"ocsfv1.3.0authorizesessionAuthorizeSession","type":"object","description":"Authorize Session events report privileges or groups assigned to a new user session, usually at login time.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0authorizesessionActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Identity & Access Management"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0authorizesessionCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0authorizesessionClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"An addressable device, computer system or host."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"The Endpoint for which the user session was targeted."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"group":{"$ref":"#/components/schemas/ocsfv1.3.0Group","nullable":true,"description":"Group that was assigned to the new user session."},"http_request":{"$ref":"#/components/schemas/ocsfv1.3.0HttpRequest","nullable":true,"description":"Details about the underlying HTTP request."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"privileges":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of sensitive privileges, assigned to the new user session."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"session":{"$ref":"#/components/schemas/ocsfv1.3.0Session","nullable":true,"description":"The user session with the assigned privileges."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0authorizesessionSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"Details about the source of the IAM activity."},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0authorizesessionStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0authorizesessionTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"user":{"$ref":"#/components/schemas/ocsfv1.3.0User","description":"The user to which new privileges were assigned."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid","user"]}},"components/schemas/ocsfv1.3.0authorizesessionCategoryUid":{"id":"components/schemas/ocsfv1.3.0authorizesessionCategoryUid","kind":"json-schema","title":"ocsfv1.3.0authorizesessionCategoryUid","data":{"title":"ocsfv1.3.0authorizesessionCategoryUid","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CategoryUid is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - AccessManagement: Identity & Access Management (IAM) events relate to the supervision of the system's authentication and access control model. Examples of such events are the success or failure of authentication, granting of authority, password change, entity change, privileged use etc."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0authorizesessionClassUid":{"id":"components/schemas/ocsfv1.3.0authorizesessionClassUid","kind":"json-schema","title":"ocsfv1.3.0authorizesessionClassUid","data":{"title":"ocsfv1.3.0authorizesessionClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n3003 - AuthorizeSession: Authorize Session events report privileges or groups assigned to a new user session, usually at login time."}},"components/schemas/ocsfv1.3.0authorizesessionSeverityId":{"id":"components/schemas/ocsfv1.3.0authorizesessionSeverityId","kind":"json-schema","title":"ocsfv1.3.0authorizesessionSeverityId","data":{"title":"ocsfv1.3.0authorizesessionSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0authorizesessionStatusId":{"id":"components/schemas/ocsfv1.3.0authorizesessionStatusId","kind":"json-schema","title":"ocsfv1.3.0authorizesessionStatusId","data":{"title":"ocsfv1.3.0authorizesessionStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0authorizesessionTypeUid":{"id":"components/schemas/ocsfv1.3.0authorizesessionTypeUid","kind":"json-schema","title":"ocsfv1.3.0authorizesessionTypeUid","data":{"title":"ocsfv1.3.0authorizesessionTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n300300 - Unknown\n300301 - AssignPrivileges: Assign special privileges to a new logon.\n300302 - AssignGroups: Assign special groups to a new logon.\n300399 - Other"}},"components/schemas/ocsfv1.3.0EmailAddress":{"id":"components/schemas/ocsfv1.3.0EmailAddress","kind":"json-schema","title":"ocsfv1.3.0EmailAddress","data":{"title":"ocsfv1.3.0EmailAddress","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Email address. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"john_doe@example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0FileName":{"id":"components/schemas/ocsfv1.3.0FileName","kind":"json-schema","title":"ocsfv1.3.0FileName","data":{"title":"ocsfv1.3.0FileName","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"File name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"text-file.txt"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Hash":{"id":"components/schemas/ocsfv1.3.0Hash","kind":"json-schema","title":"ocsfv1.3.0Hash","data":{"title":"ocsfv1.3.0Hash","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Hash. A unique value that corresponds to the content of the file, image, ja3_hash or hassh found in the schema. For example MD5: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3172ac7e2b55cbb81f04a6e65855a628"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Hostname":{"id":"components/schemas/ocsfv1.3.0Hostname","kind":"json-schema","title":"ocsfv1.3.0Hostname","data":{"title":"ocsfv1.3.0Hostname","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Unique name assigned to a device connected to a computer network. A domain name in general is an Internet address that can be resolved through the Domain Name System (DNS). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"r2-d2.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0IPAddress":{"id":"components/schemas/ocsfv1.3.0IPAddress","kind":"json-schema","title":"ocsfv1.3.0IPAddress","data":{"title":"ocsfv1.3.0IPAddress","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Internet Protocol address (IP address), in either IPv4 or IPv6 format. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"192.168.200.24"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2001:0db8:85a3:0000:0000:8a2e:0370:7334"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0MACAddress":{"id":"components/schemas/ocsfv1.3.0MACAddress","kind":"json-schema","title":"ocsfv1.3.0MACAddress","data":{"title":"ocsfv1.3.0MACAddress","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Media Access Control (MAC) address. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"18:36:F3:98:4F:9A"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Port":{"id":"components/schemas/ocsfv1.3.0Port","kind":"json-schema","title":"ocsfv1.3.0Port","data":{"title":"ocsfv1.3.0Port","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The TCP/UDP port number. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"80"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"22"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0ProcessName":{"id":"components/schemas/ocsfv1.3.0ProcessName","kind":"json-schema","title":"ocsfv1.3.0ProcessName","data":{"title":"ocsfv1.3.0ProcessName","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Process name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notepad"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Subnet":{"id":"components/schemas/ocsfv1.3.0Subnet","kind":"json-schema","title":"ocsfv1.3.0Subnet","data":{"title":"ocsfv1.3.0Subnet","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The subnet represented in a CIDR notation, using the format network_address/prefix_length. The network_address can be in either IPv4 or IPv6 format. The prefix length indicates the number of bits used for the network portion, and the remaining bits are available for host addresses within that subnet. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"div","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"192.168.1.0/24"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2001:0db8:85a3:0000::/64"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Timestamp":{"id":"components/schemas/ocsfv1.3.0Timestamp","kind":"json-schema","title":"ocsfv1.3.0Timestamp","data":{"title":"ocsfv1.3.0Timestamp","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1618524549901"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0URLString":{"id":"components/schemas/ocsfv1.3.0URLString","kind":"json-schema","title":"ocsfv1.3.0URLString","data":{"title":"ocsfv1.3.0URLString","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Uniform Resource Locator (URL) string. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http://www.example.com/download/trouble.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0UserName":{"id":"components/schemas/ocsfv1.3.0UserName","kind":"json-schema","title":"ocsfv1.3.0UserName","data":{"title":"ocsfv1.3.0UserName","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"john_doe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0baseeventActivityId":{"id":"components/schemas/ocsfv1.3.0baseeventActivityId","kind":"json-schema","title":"ocsfv1.3.0baseeventActivityId","data":{"title":"ocsfv1.3.0baseeventActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0baseeventBaseEvent":{"id":"components/schemas/ocsfv1.3.0baseeventBaseEvent","kind":"json-schema","title":"ocsfv1.3.0baseeventBaseEvent","data":{"title":"ocsfv1.3.0baseeventBaseEvent","type":"object","description":"The base event is a generic and concrete event. It also defines a set of attributes available in most event classes. As a generic event that does not belong to any event category, it could be used to log events that are not otherwise defined by the schema.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0baseeventActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0baseeventCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0baseeventClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0baseeventSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0baseeventStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0baseeventCategoryUid":{"id":"components/schemas/ocsfv1.3.0baseeventCategoryUid","kind":"json-schema","title":"ocsfv1.3.0baseeventCategoryUid","data":{"title":"ocsfv1.3.0baseeventCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n0 - Uncategorized"}},"components/schemas/ocsfv1.3.0baseeventClassUid":{"id":"components/schemas/ocsfv1.3.0baseeventClassUid","kind":"json-schema","title":"ocsfv1.3.0baseeventClassUid","data":{"title":"ocsfv1.3.0baseeventClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n0 - BaseEvent"}},"components/schemas/ocsfv1.3.0baseeventSeverityId":{"id":"components/schemas/ocsfv1.3.0baseeventSeverityId","kind":"json-schema","title":"ocsfv1.3.0baseeventSeverityId","data":{"title":"ocsfv1.3.0baseeventSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0baseeventStatusId":{"id":"components/schemas/ocsfv1.3.0baseeventStatusId","kind":"json-schema","title":"ocsfv1.3.0baseeventStatusId","data":{"title":"ocsfv1.3.0baseeventStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0cloudactivityActivityId":{"id":"components/schemas/ocsfv1.3.0cloudactivityActivityId","kind":"json-schema","title":"ocsfv1.3.0cloudactivityActivityId","data":{"title":"ocsfv1.3.0cloudactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Authorize: An authorizaon check was performed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Create: A resource was created."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Update: One or more web resources were updated."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Delete: One or more web resources were deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Send: A resource was sent to an external destination."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Upload: A resource was uploaded from an external source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Download: A resource was downloaded to an external source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - MetadataChange: The metadata of a resource was changed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - SharingChange: The sharing status of a resource was changed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Read: A resource was accessed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Install: An application was installed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - Uninstall: An application was uninstalled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - MembershipChange: The membership relating to a resource was changed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Informational: An informational event was logged."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Export: A resource was exported."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - Execute: A task, action, or script was executed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0cloudactivityCategoryUid":{"id":"components/schemas/ocsfv1.3.0cloudactivityCategoryUid","kind":"json-schema","title":"ocsfv1.3.0cloudactivityCategoryUid","data":{"title":"ocsfv1.3.0cloudactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n6 - ApplicationActivity: Application Activity events report detailed information about the behavior of applications and services."}},"components/schemas/ocsfv1.3.0cloudactivityClassUid":{"id":"components/schemas/ocsfv1.3.0cloudactivityClassUid","kind":"json-schema","title":"ocsfv1.3.0cloudactivityClassUid","data":{"title":"ocsfv1.3.0cloudactivityClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n6090 - CloudActivity: Cloud activity events report events and actions logged or collected from a cloud environment. This class is based on Web Resources Activity, but is more broad and suited to event logs with diverse types of data available."}},"components/schemas/ocsfv1.3.0cloudactivityCloudActivity":{"id":"components/schemas/ocsfv1.3.0cloudactivityCloudActivity","kind":"json-schema","title":"ocsfv1.3.0cloudactivityCloudActivity","data":{"title":"ocsfv1.3.0cloudactivityCloudActivity","type":"object","description":"Cloud activity events report events and actions logged or collected from a cloud environment. This class is based on Web Resources Activity, but is more broad and suited to event logs with diverse types of data available.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0cloudactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor which initiated or caused the action or event, as used in 3001/Account Change."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Application Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0cloudactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0cloudactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"The device which was used by the user to cause the event, or which the event is otherwise about or related to."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"Details about server providing the web resources."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"email":{"$ref":"#/components/schemas/ocsfv1.3.0Email","nullable":true,"description":"An email which related to the event, such as a mail that was sent, scanned, or caused by the event."},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"file":{"$ref":"#/components/schemas/ocsfv1.3.0File","nullable":true,"description":"The file which is related to the event, such as an uploaded, downloaded, deleted, or modified file."},"http_request":{"$ref":"#/components/schemas/ocsfv1.3.0HttpRequest","nullable":true,"description":"Details about the underlying HTTP request."},"http_response":{"$ref":"#/components/schemas/ocsfv1.3.0HttpResponse","nullable":true,"description":"Details about the HTTP response, if available."},"meeting":{"$ref":"#/components/schemas/ocsfv1.3.0Meeting","nullable":true,"description":"Information relating to a meeting, such as attendees, start/end times, and meeting details."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"messaging":{"$ref":"#/components/schemas/ocsfv1.3.0Messaging","nullable":true,"description":"Information related to instant messaging, such as sending messages, adding users to channels, etc."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"parameters":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A place to store parameters which were passed to a command, application, program, etc. This could include CLI parameters, the configuration used to launch an app, etc."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0cloudactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"sharing":{"$ref":"#/components/schemas/ocsfv1.3.0Sharing","nullable":true,"description":"Information about how and with whom a resource was shared, such as sharing permissions and scope."},"src_app":{"$ref":"#/components/schemas/ocsfv1.3.0Product","nullable":true,"description":"The app which initiated or caused an action or event, such as the client."},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"Details about the endpoint from which the request originated."},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0cloudactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"target_app":{"$ref":"#/components/schemas/ocsfv1.3.0Product","nullable":true,"description":"The app which is the target of the action or event. For example, when a user adds an app to Teams, the app which was added would be the target app, and Teams would be the source app."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"tls":{"$ref":"#/components/schemas/ocsfv1.3.0Tls","nullable":true,"description":"The Transport Layer Security (TLS) attributes, if available."},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0cloudactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"web_resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0WebResource"},"description":"Describes details about web resources that were affected by an activity/event."},"web_resources_result":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0WebResource"},"nullable":true,"description":"The results of the activity on web resources. It should contain the new values of the changed attributes of the web resources."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid","web_resources"]}},"components/schemas/ocsfv1.3.0cloudactivitySeverityId":{"id":"components/schemas/ocsfv1.3.0cloudactivitySeverityId","kind":"json-schema","title":"ocsfv1.3.0cloudactivitySeverityId","data":{"title":"ocsfv1.3.0cloudactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0cloudactivityStatusId":{"id":"components/schemas/ocsfv1.3.0cloudactivityStatusId","kind":"json-schema","title":"ocsfv1.3.0cloudactivityStatusId","data":{"title":"ocsfv1.3.0cloudactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0cloudactivityTypeUid":{"id":"components/schemas/ocsfv1.3.0cloudactivityTypeUid","kind":"json-schema","title":"ocsfv1.3.0cloudactivityTypeUid","data":{"title":"ocsfv1.3.0cloudactivityTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n609000 - Unknown\n609001 - Authorize: An authorizaon check was performed.\n609002 - Create: A resource was created.\n609003 - Update: One or more web resources were updated.\n609004 - Delete: One or more web resources were deleted.\n609005 - Send: A resource was sent to an external destination.\n609006 - Upload: A resource was uploaded from an external source.\n609007 - Download: A resource was downloaded to an external source.\n609008 - MetadataChange: The metadata of a resource was changed.\n609009 - SharingChange: The sharing status of a resource was changed.\n609010 - Read: A resource was accessed.\n609011 - Install: An application was installed.\n609012 - Uninstall: An application was uninstalled.\n609013 - MembershipChange: The membership relating to a resource was changed.\n609014 - Informational: An informational event was logged.\n609015 - Export: A resource was exported.\n609016 - Execute: A task, action, or script was executed.\n609099 - Other"}},"components/schemas/ocsfv1.3.0compliancefindingActivityId":{"id":"components/schemas/ocsfv1.3.0compliancefindingActivityId","kind":"json-schema","title":"ocsfv1.3.0compliancefindingActivityId","data":{"title":"ocsfv1.3.0compliancefindingActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Create: A finding was created."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Update: A finding was updated."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Close: A finding was closed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0compliancefindingCategoryUid":{"id":"components/schemas/ocsfv1.3.0compliancefindingCategoryUid","kind":"json-schema","title":"ocsfv1.3.0compliancefindingCategoryUid","data":{"title":"ocsfv1.3.0compliancefindingCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n2 - Findings: Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products."}},"components/schemas/ocsfv1.3.0compliancefindingClassUid":{"id":"components/schemas/ocsfv1.3.0compliancefindingClassUid","kind":"json-schema","title":"ocsfv1.3.0compliancefindingClassUid","data":{"title":"ocsfv1.3.0compliancefindingClassUid","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ClassUid is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2003 - ComplianceFinding: Compliance Finding events describe results of evaluations performed against resources, to check compliance with various Industry Frameworks or Security Standards such as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST SP 800-53, CIS AWS Foundations Benchmark v1.4.0, ISO/IEC 27001"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" etc."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0compliancefindingComplianceFinding":{"id":"components/schemas/ocsfv1.3.0compliancefindingComplianceFinding","kind":"json-schema","title":"ocsfv1.3.0compliancefindingComplianceFinding","data":{"title":"ocsfv1.3.0compliancefindingComplianceFinding","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Compliance Finding events describe results of evaluations performed against resources, to check compliance with various Industry Frameworks or Security Standards such as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST SP 800-53, CIS AWS Foundations Benchmark v1.4.0, ISO/IEC 27001"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" etc."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingActivityId","description":"The normalized identifier of the finding activity."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The finding activity name, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"comment":{"type":"string","nullable":true,"description":"A user provided comment about the finding."},"compliance":{"$ref":"#/components/schemas/ocsfv1.3.0Compliance","description":"The compliance object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS, NIST etc.) and contains compliance related details."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the affected device/host. It can be used in conjunction with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Affected Resource(s)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. Specific details about an AWS EC2 instance, that is affected by the Finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time of the most recent event included in the finding."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the most recent event included in the finding."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"finding_info":{"$ref":"#/components/schemas/ocsfv1.3.0FindingInfo","description":"Describes the supporting information about a generated finding."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"remediation":{"$ref":"#/components/schemas/ocsfv1.3.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"resource":{"$ref":"#/components/schemas/ocsfv1.3.0ResourceDetails","nullable":true,"description":"Describes details about the resource that is the subject of the compliance check."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0ResourceDetails"},"nullable":true,"description":"Describes details about the resource/resouces that are the subject of the compliance check."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time of the least recent event included in the finding."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the least recent event included in the finding."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingStatusId","nullable":true,"description":"The normalized status identifier of the Finding, set by the consumer."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0compliancefindingTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","compliance","finding_info","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0compliancefindingConfidenceId":{"id":"components/schemas/ocsfv1.3.0compliancefindingConfidenceId","kind":"json-schema","title":"ocsfv1.3.0compliancefindingConfidenceId","data":{"title":"ocsfv1.3.0compliancefindingConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0compliancefindingSeverityId":{"id":"components/schemas/ocsfv1.3.0compliancefindingSeverityId","kind":"json-schema","title":"ocsfv1.3.0compliancefindingSeverityId","data":{"title":"ocsfv1.3.0compliancefindingSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0compliancefindingStatusId":{"id":"components/schemas/ocsfv1.3.0compliancefindingStatusId","kind":"json-schema","title":"ocsfv1.3.0compliancefindingStatusId","data":{"title":"ocsfv1.3.0compliancefindingStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - New: The Finding is new and yet to be reviewed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - InProgress: The Finding is under review."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Suppressed: The Finding was reviewed, determined to be benign or a false positive and is now suppressed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Resolved: The Finding was reviewed, remediated and is now considered resolved."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0compliancefindingTypeUid":{"id":"components/schemas/ocsfv1.3.0compliancefindingTypeUid","kind":"json-schema","title":"ocsfv1.3.0compliancefindingTypeUid","data":{"title":"ocsfv1.3.0compliancefindingTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n200300 - Unknown\n200301 - Create: A finding was created.\n200302 - Update: A finding was updated.\n200303 - Close: A finding was closed.\n200399 - Other"}},"components/schemas/ocsfv1.3.0configstateActivityId":{"id":"components/schemas/ocsfv1.3.0configstateActivityId","kind":"json-schema","title":"ocsfv1.3.0configstateActivityId","data":{"title":"ocsfv1.3.0configstateActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Log: The discovered information is via a log."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Collect: The discovered information is via a collection process."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0configstateCategoryUid":{"id":"components/schemas/ocsfv1.3.0configstateCategoryUid","kind":"json-schema","title":"ocsfv1.3.0configstateCategoryUid","data":{"title":"ocsfv1.3.0configstateCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects."}},"components/schemas/ocsfv1.3.0configstateClassUid":{"id":"components/schemas/ocsfv1.3.0configstateClassUid","kind":"json-schema","title":"ocsfv1.3.0configstateClassUid","data":{"title":"ocsfv1.3.0configstateClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n5002 - DeviceConfigState: Device Config State events report device configuration data and CIS Benchmark results."}},"components/schemas/ocsfv1.3.0configstateConfigState":{"id":"components/schemas/ocsfv1.3.0configstateConfigState","kind":"json-schema","title":"ocsfv1.3.0configstateConfigState","data":{"title":"ocsfv1.3.0configstateConfigState","type":"object","description":"Device Config State events report device configuration data and CIS Benchmark results.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0configstateActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0configstateCategoryUid","description":"The category unique identifier of the event."},"cis_benchmark_result":{"$ref":"#/components/schemas/ocsfv1.3.0CisBenchmarkResult","nullable":true,"description":"The CIS benchmark result."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0configstateClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","description":"The device that is being discovered by an inventory process."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0configstateSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0configstateStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0configstateTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","device","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0configstateSeverityId":{"id":"components/schemas/ocsfv1.3.0configstateSeverityId","kind":"json-schema","title":"ocsfv1.3.0configstateSeverityId","data":{"title":"ocsfv1.3.0configstateSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0configstateStatusId":{"id":"components/schemas/ocsfv1.3.0configstateStatusId","kind":"json-schema","title":"ocsfv1.3.0configstateStatusId","data":{"title":"ocsfv1.3.0configstateStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0configstateTypeUid":{"id":"components/schemas/ocsfv1.3.0configstateTypeUid","kind":"json-schema","title":"ocsfv1.3.0configstateTypeUid","data":{"title":"ocsfv1.3.0configstateTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n500200 - Unknown\n500201 - Log: The discovered information is via a log.\n500202 - Collect: The discovered information is via a collection process.\n500299 - Other"}},"components/schemas/ocsfv1.3.0detectionfindingActionId":{"id":"components/schemas/ocsfv1.3.0detectionfindingActionId","kind":"json-schema","title":"ocsfv1.3.0detectionfindingActionId","data":{"title":"ocsfv1.3.0detectionfindingActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Count', 'Uncorrected', 'Isolated', 'Quarantined' or 'Exonerated'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action was not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0detectionfindingActivityId":{"id":"components/schemas/ocsfv1.3.0detectionfindingActivityId","kind":"json-schema","title":"ocsfv1.3.0detectionfindingActivityId","data":{"title":"ocsfv1.3.0detectionfindingActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Create: A finding was created."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Update: A finding was updated."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Close: A finding was closed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0detectionfindingCategoryUid":{"id":"components/schemas/ocsfv1.3.0detectionfindingCategoryUid","kind":"json-schema","title":"ocsfv1.3.0detectionfindingCategoryUid","data":{"title":"ocsfv1.3.0detectionfindingCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n2 - Findings: Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products."}},"components/schemas/ocsfv1.3.0detectionfindingClassUid":{"id":"components/schemas/ocsfv1.3.0detectionfindingClassUid","kind":"json-schema","title":"ocsfv1.3.0detectionfindingClassUid","data":{"title":"ocsfv1.3.0detectionfindingClassUid","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ClassUid is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2004 - DetectionFinding: A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the product is a security control, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile should be applied and its "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"attacks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" information should be duplicated into the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0detectionfindingConfidenceId":{"id":"components/schemas/ocsfv1.3.0detectionfindingConfidenceId","kind":"json-schema","title":"ocsfv1.3.0detectionfindingConfidenceId","data":{"title":"ocsfv1.3.0detectionfindingConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0detectionfindingDetectionFinding":{"id":"components/schemas/ocsfv1.3.0detectionfindingDetectionFinding","kind":"json-schema","title":"ocsfv1.3.0detectionfindingDetectionFinding","data":{"title":"ocsfv1.3.0detectionfindingDetectionFinding","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the product is a security control, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile should be applied and its "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"attacks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" information should be duplicated into the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. Dispositions conform to an action of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed' or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Denied' in most cases. Note that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"99"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Other' is not an option. No action would equate to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingActivityId","description":"The normalized identifier of the finding activity."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The finding activity name, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects describing the tactics, techniques & sub-techniques identified by a security control or finding."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"comment":{"type":"string","nullable":true,"description":"A user provided comment about the finding."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the affected device/host. It can be used in conjunction with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Affected Resource(s)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. Specific details about an AWS EC2 instance, that is affected by the Finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time of the most recent event included in the finding."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the most recent event included in the finding."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"evidences":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Evidences"},"nullable":true,"description":"Describes various evidence artifacts associated to the activity/activities that triggered a security detection."},"finding_info":{"$ref":"#/components/schemas/ocsfv1.3.0FindingInfo","description":"Describes the supporting information about a generated finding."},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.3.0FirewallRule","nullable":true,"description":"The firewall rule that triggered the event."},"impact":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"impact_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingImpactId","nullable":true,"description":"The normalized impact of the finding."},"impact_score":{"type":"integer","nullable":true,"description":"The impact of the finding, valid range 0-100."},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"remediation":{"$ref":"#/components/schemas/ocsfv1.3.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0ResourceDetails"},"nullable":true,"description":"Describes details about resources that were the target of the activity that triggered the finding."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time of the least recent event included in the finding."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the least recent event included in the finding."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingStatusId","nullable":true,"description":"The normalized status identifier of the Finding, set by the consumer."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"vulnerabilities":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Vulnerability"},"nullable":true,"description":"Describes vulnerabilities reported in a Detection Finding."}},"required":["activity_id","category_uid","class_uid","finding_info","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0detectionfindingDispositionId":{"id":"components/schemas/ocsfv1.3.0detectionfindingDispositionId","kind":"json-schema","title":"ocsfv1.3.0detectionfindingDispositionId","data":{"title":"ocsfv1.3.0detectionfindingDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0detectionfindingImpactId":{"id":"components/schemas/ocsfv1.3.0detectionfindingImpactId","kind":"json-schema","title":"ocsfv1.3.0detectionfindingImpactId","data":{"title":"ocsfv1.3.0detectionfindingImpactId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ImpactId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized impact is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The impact is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"impact"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0detectionfindingRiskLevelId":{"id":"components/schemas/ocsfv1.3.0detectionfindingRiskLevelId","kind":"json-schema","title":"ocsfv1.3.0detectionfindingRiskLevelId","data":{"title":"ocsfv1.3.0detectionfindingRiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0detectionfindingSeverityId":{"id":"components/schemas/ocsfv1.3.0detectionfindingSeverityId","kind":"json-schema","title":"ocsfv1.3.0detectionfindingSeverityId","data":{"title":"ocsfv1.3.0detectionfindingSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0detectionfindingStatusId":{"id":"components/schemas/ocsfv1.3.0detectionfindingStatusId","kind":"json-schema","title":"ocsfv1.3.0detectionfindingStatusId","data":{"title":"ocsfv1.3.0detectionfindingStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - New: The Finding is new and yet to be reviewed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - InProgress: The Finding is under review."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Suppressed: The Finding was reviewed, determined to be benign or a false positive and is now suppressed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Resolved: The Finding was reviewed, remediated and is now considered resolved."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0detectionfindingTypeUid":{"id":"components/schemas/ocsfv1.3.0detectionfindingTypeUid","kind":"json-schema","title":"ocsfv1.3.0detectionfindingTypeUid","data":{"title":"ocsfv1.3.0detectionfindingTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n200400 - Unknown\n200401 - Create: A finding was created.\n200402 - Update: A finding was updated.\n200403 - Close: A finding was closed.\n200499 - Other"}},"components/schemas/ocsfv1.3.0dnsactivityActionId":{"id":"components/schemas/ocsfv1.3.0dnsactivityActionId","kind":"json-schema","title":"ocsfv1.3.0dnsactivityActionId","data":{"title":"ocsfv1.3.0dnsactivityActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Count', 'Uncorrected', 'Isolated', 'Quarantined' or 'Exonerated'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action was not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0dnsactivityActivityId":{"id":"components/schemas/ocsfv1.3.0dnsactivityActivityId","kind":"json-schema","title":"ocsfv1.3.0dnsactivityActivityId","data":{"title":"ocsfv1.3.0dnsactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Query: The DNS query request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Response: The DNS query response."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Traffic: Bidirectional DNS request and response traffic."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0dnsactivityCategoryUid":{"id":"components/schemas/ocsfv1.3.0dnsactivityCategoryUid","kind":"json-schema","title":"ocsfv1.3.0dnsactivityCategoryUid","data":{"title":"ocsfv1.3.0dnsactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n4 - NetworkActivity: Network Activity events."}},"components/schemas/ocsfv1.3.0dnsactivityClassUid":{"id":"components/schemas/ocsfv1.3.0dnsactivityClassUid","kind":"json-schema","title":"ocsfv1.3.0dnsactivityClassUid","data":{"title":"ocsfv1.3.0dnsactivityClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n4003 - DNSActivity: DNS Activity events report DNS queries and answers as seen on the network."}},"components/schemas/ocsfv1.3.0dnsactivityDispositionId":{"id":"components/schemas/ocsfv1.3.0dnsactivityDispositionId","kind":"json-schema","title":"ocsfv1.3.0dnsactivityDispositionId","data":{"title":"ocsfv1.3.0dnsactivityDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0dnsactivityDnsActivity":{"id":"components/schemas/ocsfv1.3.0dnsactivityDnsActivity","kind":"json-schema","title":"ocsfv1.3.0dnsactivityDnsActivity","data":{"title":"ocsfv1.3.0dnsactivityDnsActivity","type":"object","description":"DNS Activity events report DNS queries and answers as seen on the network.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.3.0dnsactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. Dispositions conform to an action of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed' or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Denied' in most cases. Note that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"99"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Other' is not an option. No action would equate to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0dnsactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"answers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0DnsAnswer"},"nullable":true,"description":"The Domain Name System (DNS) answers."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"app_name":{"type":"string","nullable":true,"description":"The name of the application associated with the event or object."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects describing the tactics, techniques & sub-techniques identified by a security control or finding."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Network Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0dnsactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0dnsactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"connection_info":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkConnectionInfo","nullable":true,"description":"The network connection information."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"An addressable device, computer system or host."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.3.0dnsactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"The responder (server) in a network connection."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.3.0FirewallRule","nullable":true,"description":"The firewall rule that triggered the event."},"ja4_fingerprint_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Ja4Fingerprint"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of the JA4+ network fingerprints."},"children":[],"type":"text"}],"type":"paragraph"}]},"load_balancer":{"$ref":"#/components/schemas/ocsfv1.3.0LoadBalancer","nullable":true,"description":"The Load Balancer object contains information related to the device that is distributing incoming traffic to specified destinations."},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"proxy":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkProxy","nullable":true,"description":"The proxy (server) in a network connection."},"proxy_connection_info":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkConnectionInfo","nullable":true,"description":"The connection information from the proxy server to the remote server."},"proxy_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkProxy","nullable":true,"description":"The proxy (server) in a network connection."},"proxy_http_request":{"$ref":"#/components/schemas/ocsfv1.3.0HttpRequest","nullable":true,"description":"The HTTP Request from the proxy server to the remote server."},"proxy_http_response":{"$ref":"#/components/schemas/ocsfv1.3.0HttpResponse","nullable":true,"description":"The HTTP Response from the remote server to the proxy server."},"proxy_tls":{"$ref":"#/components/schemas/ocsfv1.3.0Tls","nullable":true,"description":"The TLS protocol negotiated between the proxy server and the remote server."},"proxy_traffic":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkTraffic","nullable":true,"description":"The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time."},"query":{"$ref":"#/components/schemas/ocsfv1.3.0DnsQuery","nullable":true,"description":"The Domain Name System (DNS) query."},"query_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The Domain Name System (DNS) query time."},"query_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The Domain Name System (DNS) query time."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"rcode":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The DNS server response code, normalized to the caption of the rcode_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"rcode_id":{"$ref":"#/components/schemas/ocsfv1.3.0dnsactivityRcodeId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized identifier of the DNS server response code. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc6895"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-6895"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"response_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The Domain Name System (DNS) response time."},"response_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The Domain Name System (DNS) response time."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0dnsactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"The initiator (client) of the network connection."},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0dnsactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"tls":{"$ref":"#/components/schemas/ocsfv1.3.0Tls","nullable":true,"description":"The Transport Layer Security (TLS) attributes."},"traffic":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkTraffic","nullable":true,"description":"The network traffic refers to the amount of data moving across a network at a given point of time. Intended to be used alongside Network Connection."},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0dnsactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0dnsactivityRcodeId":{"id":"components/schemas/ocsfv1.3.0dnsactivityRcodeId","kind":"json-schema","title":"ocsfv1.3.0dnsactivityRcodeId","data":{"title":"ocsfv1.3.0dnsactivityRcodeId","type":"integer","description":"RcodeId is an enum, and the following values are allowed.\n0 - NoError: No Error.\n1 - FormError: Format Error.\n2 - ServError: Server Failure.\n3 - NXDomain: Non-Existent Domain.\n4 - NotImp: Not Implemented.\n5 - Refused: Query Refused.\n6 - YXDomain: Name Exists when it should not.\n7 - YXRRSet: RR Set Exists when it should not.\n8 - NXRRSet: RR Set that should exist does not.\n9 - NotAuth: Not Authorized or Server Not Authoritative for zone.\n10 - NotZone: Name not contained in zone.\n11 - DSOTYPENI: DSO-TYPE Not Implemented.\n16 - VERS: TSIG Signature Failure or Bad OPT Version.\n17 - BADKEY: Key not recognized.\n18 - BADTIME: Signature out of time window.\n19 - BADMODE: Bad TKEY Mode.\n20 - BADNAME: Duplicate key name.\n21 - BADALG: Algorithm not supported.\n22 - BADTRUNC: Bad Truncation.\n23 - BADCOOKIE: Bad/missing Server Cookie.\n24 - Unassigned: The codes deemed to be unassigned by the RFC (unassigned codes: 12-15, 24-3840, 4096-65534).\n25 - Reserved: The codes deemed to be reserved by the RFC (codes: 3841-4095, 65535).\n99 - Other: The dns response code is not defined by the RFC."}},"components/schemas/ocsfv1.3.0dnsactivitySeverityId":{"id":"components/schemas/ocsfv1.3.0dnsactivitySeverityId","kind":"json-schema","title":"ocsfv1.3.0dnsactivitySeverityId","data":{"title":"ocsfv1.3.0dnsactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0dnsactivityStatusId":{"id":"components/schemas/ocsfv1.3.0dnsactivityStatusId","kind":"json-schema","title":"ocsfv1.3.0dnsactivityStatusId","data":{"title":"ocsfv1.3.0dnsactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0dnsactivityTypeUid":{"id":"components/schemas/ocsfv1.3.0dnsactivityTypeUid","kind":"json-schema","title":"ocsfv1.3.0dnsactivityTypeUid","data":{"title":"ocsfv1.3.0dnsactivityTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n400300 - Unknown\n400301 - Query: The DNS query request.\n400302 - Response: The DNS query response.\n400306 - Traffic: Bidirectional DNS request and response traffic.\n400399 - Other"}},"components/schemas/ocsfv1.3.0entitymanagementActivityId":{"id":"components/schemas/ocsfv1.3.0entitymanagementActivityId","kind":"json-schema","title":"ocsfv1.3.0entitymanagementActivityId","data":{"title":"ocsfv1.3.0entitymanagementActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Create: Create a new managed entity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Read: Read an existing managed entity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Update: Update an existing managed entity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Delete: Delete a managed entity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Move: Move or rename an existing managed entity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Enroll: Enroll an existing managed entity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Unenroll: Unenroll an existing managed entity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Enable: Enable an existing managed entity. Note: This is typically regarded as a semi-permanent, editor visible, syncable change."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Disable: Disable an existing managed entity. Note: This is typically regarded as a semi-permanent, editor visible, syncable change."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Activate: Activate an existing managed entity. Note: This is a typically regarded as a transient change, a change of state of the engine."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Deactivate: Deactivate an existing managed entity. Note: This is a typically regarded as a transient change, a change of state of the engine."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - Suspend: Suspend an existing managed entity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Resume: Resume (unsuspend) an existing managed entity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0entitymanagementCategoryUid":{"id":"components/schemas/ocsfv1.3.0entitymanagementCategoryUid","kind":"json-schema","title":"ocsfv1.3.0entitymanagementCategoryUid","data":{"title":"ocsfv1.3.0entitymanagementCategoryUid","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CategoryUid is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - AccessManagement: Identity & Access Management (IAM) events relate to the supervision of the system's authentication and access control model. Examples of such events are the success or failure of authentication, granting of authority, password change, entity change, privileged use etc."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0entitymanagementClassUid":{"id":"components/schemas/ocsfv1.3.0entitymanagementClassUid","kind":"json-schema","title":"ocsfv1.3.0entitymanagementClassUid","data":{"title":"ocsfv1.3.0entitymanagementClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n3004 - EntityManagement: Entity Management events report activity by a managed client, a micro service, or a user at a management console. The activity can be a create, read, update, and delete operation on a managed entity."}},"components/schemas/ocsfv1.3.0entitymanagementEntityManagement":{"id":"components/schemas/ocsfv1.3.0entitymanagementEntityManagement","kind":"json-schema","title":"ocsfv1.3.0entitymanagementEntityManagement","data":{"title":"ocsfv1.3.0entitymanagementEntityManagement","type":"object","description":"Entity Management events report activity by a managed client, a micro service, or a user at a management console. The activity can be a create, read, update, and delete operation on a managed entity.","properties":{"access_list":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of requested access rights."},"access_mask":{"type":"integer","nullable":true,"description":"The access mask in a platform-native format."},"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0entitymanagementActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"Used for when the entity acting upon another entity is a process or user."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Identity & Access Management"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0entitymanagementCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0entitymanagementClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"comment":{"type":"string","nullable":true,"description":"The user provided comment about why the entity was changed."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"An addressable device, computer system or host."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"entity":{"$ref":"#/components/schemas/ocsfv1.3.0ManagedEntity","description":"The managed entity that is being acted upon."},"entity_result":{"$ref":"#/components/schemas/ocsfv1.3.0ManagedEntity","nullable":true,"description":"The updated managed entity."},"http_request":{"$ref":"#/components/schemas/ocsfv1.3.0HttpRequest","nullable":true,"description":"Details about the underlying HTTP request."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0entitymanagementSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"Details about the source of the IAM activity."},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0entitymanagementStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0entitymanagementTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","entity","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0entitymanagementSeverityId":{"id":"components/schemas/ocsfv1.3.0entitymanagementSeverityId","kind":"json-schema","title":"ocsfv1.3.0entitymanagementSeverityId","data":{"title":"ocsfv1.3.0entitymanagementSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0entitymanagementStatusId":{"id":"components/schemas/ocsfv1.3.0entitymanagementStatusId","kind":"json-schema","title":"ocsfv1.3.0entitymanagementStatusId","data":{"title":"ocsfv1.3.0entitymanagementStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0entitymanagementTypeUid":{"id":"components/schemas/ocsfv1.3.0entitymanagementTypeUid","kind":"json-schema","title":"ocsfv1.3.0entitymanagementTypeUid","data":{"title":"ocsfv1.3.0entitymanagementTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n300400 - Unknown\n300401 - Create: Create a new managed entity.\n300402 - Read: Read an existing managed entity.\n300403 - Update: Update an existing managed entity.\n300404 - Delete: Delete a managed entity.\n300405 - Move: Move or rename an existing managed entity.\n300406 - Enroll: Enroll an existing managed entity.\n300407 - Unenroll: Unenroll an existing managed entity.\n300408 - Enable: Enable an existing managed entity. Note: This is typically regarded as a semi-permanent, editor visible, syncable change.\n300409 - Disable: Disable an existing managed entity. Note: This is typically regarded as a semi-permanent, editor visible, syncable change.\n300410 - Activate: Activate an existing managed entity. Note: This is a typically regarded as a transient change, a change of state of the engine.\n300411 - Deactivate: Deactivate an existing managed entity. Note: This is a typically regarded as a transient change, a change of state of the engine.\n300412 - Suspend: Suspend an existing managed entity.\n300413 - Resume: Resume (unsuspend) an existing managed entity.\n300499 - Other"}},"components/schemas/ocsfv1.3.0eventlogactivityActionId":{"id":"components/schemas/ocsfv1.3.0eventlogactivityActionId","kind":"json-schema","title":"ocsfv1.3.0eventlogactivityActionId","data":{"title":"ocsfv1.3.0eventlogactivityActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Count', 'Uncorrected', 'Isolated', 'Quarantined' or 'Exonerated'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action was not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0eventlogactivityActivityId":{"id":"components/schemas/ocsfv1.3.0eventlogactivityActivityId","kind":"json-schema","title":"ocsfv1.3.0eventlogactivityActivityId","data":{"title":"ocsfv1.3.0eventlogactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Clear: Clear the event log database, file, or cache."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Delete: Delete the event log database, file, or cache."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Export: Export the event log database, file, or cache."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Archive: Archive the event log database, file, or cache."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Rotate: Rotate the event log database, file, or cache."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Start: Start the event logging service."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Stop: Stop the event logging service."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Restart: Restart the event logging service."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Enable: Enable the event logging service."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Disable: Disable the event logging service."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0eventlogactivityCategoryUid":{"id":"components/schemas/ocsfv1.3.0eventlogactivityCategoryUid","kind":"json-schema","title":"ocsfv1.3.0eventlogactivityCategoryUid","data":{"title":"ocsfv1.3.0eventlogactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n1 - SystemActivity: System Activity events."}},"components/schemas/ocsfv1.3.0eventlogactivityClassUid":{"id":"components/schemas/ocsfv1.3.0eventlogactivityClassUid","kind":"json-schema","title":"ocsfv1.3.0eventlogactivityClassUid","data":{"title":"ocsfv1.3.0eventlogactivityClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n1008 - EventLogActivity: Event Log Activity events report actions pertaining to the system's event logging service(s), such as disabling logging or clearing the log data."}},"components/schemas/ocsfv1.3.0eventlogactivityDispositionId":{"id":"components/schemas/ocsfv1.3.0eventlogactivityDispositionId","kind":"json-schema","title":"ocsfv1.3.0eventlogactivityDispositionId","data":{"title":"ocsfv1.3.0eventlogactivityDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0eventlogactivityEventLog":{"id":"components/schemas/ocsfv1.3.0eventlogactivityEventLog","kind":"json-schema","title":"ocsfv1.3.0eventlogactivityEventLog","data":{"title":"ocsfv1.3.0eventlogactivityEventLog","type":"object","description":"Event Log Activity events report actions pertaining to the system's event logging service(s), such as disabling logging or clearing the log data.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.3.0eventlogactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. Dispositions conform to an action of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed' or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Denied' in most cases. Note that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"99"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Other' is not an option. No action would equate to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0eventlogactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor that performed the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects describing the tactics, techniques & sub-techniques identified by a security control or finding."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"System Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0eventlogactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0eventlogactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"The device that reported the event."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.3.0eventlogactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{"style":{"display":"inline","color":"red"}}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"targeted"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" endpoint for the event log activity."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"file":{"$ref":"#/components/schemas/ocsfv1.3.0File","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The file "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{"style":{"display":"inline","color":"red"}}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"targeted by"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" the activity. Example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"/var/log/audit.log"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.3.0FirewallRule","nullable":true,"description":"The firewall rule that triggered the event."},"log_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the event log "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"targeted by"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" the activity. Example: Windows "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Security"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"log_provider":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The logging provider or logging service "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"targeted by"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" the activity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Microsoft-Windows-Security-Auditing"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Auditd"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Syslog"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"log_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The log type, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"log_type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"log_type_id":{"$ref":"#/components/schemas/ocsfv1.3.0eventlogactivityLogTypeId","nullable":true,"description":"The normalized log type identifier."},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0eventlogactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"The source endpoint for the event log activity."},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"8"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"21"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://learn.microsoft.com/en-us/previous-versions/windows/desktop/eventlogprov/cleareventlog-method-in-class-win32-nteventlogfile"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Windows ClearEventLog"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The status detail contains additional information about the event outcome."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Success"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Privilege Missing"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Invalid Parameter"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://learn.microsoft.com/en-us/previous-versions/windows/desktop/eventlogprov/cleareventlog-method-in-class-win32-nteventlogfile"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Windows ClearEventLog"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0eventlogactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0eventlogactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0eventlogactivityLogTypeId":{"id":"components/schemas/ocsfv1.3.0eventlogactivityLogTypeId","kind":"json-schema","title":"ocsfv1.3.0eventlogactivityLogTypeId","data":{"title":"ocsfv1.3.0eventlogactivityLogTypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LogTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The log type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - OS: The log type is an Operating System log."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Application: The log type is an Application log."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The log type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"log_type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0eventlogactivitySeverityId":{"id":"components/schemas/ocsfv1.3.0eventlogactivitySeverityId","kind":"json-schema","title":"ocsfv1.3.0eventlogactivitySeverityId","data":{"title":"ocsfv1.3.0eventlogactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0eventlogactivityStatusId":{"id":"components/schemas/ocsfv1.3.0eventlogactivityStatusId","kind":"json-schema","title":"ocsfv1.3.0eventlogactivityStatusId","data":{"title":"ocsfv1.3.0eventlogactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0eventlogactivityTypeUid":{"id":"components/schemas/ocsfv1.3.0eventlogactivityTypeUid","kind":"json-schema","title":"ocsfv1.3.0eventlogactivityTypeUid","data":{"title":"ocsfv1.3.0eventlogactivityTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n100800 - Unknown\n100801 - Clear: Clear the event log database, file, or cache.\n100802 - Delete: Delete the event log database, file, or cache.\n100803 - Export: Export the event log database, file, or cache.\n100804 - Archive: Archive the event log database, file, or cache.\n100805 - Rotate: Rotate the event log database, file, or cache.\n100806 - Start: Start the event logging service.\n100807 - Stop: Stop the event logging service.\n100808 - Restart: Restart the event logging service.\n100809 - Enable: Enable the event logging service.\n100810 - Disable: Disable the event logging service.\n100899 - Other"}},"components/schemas/ocsfv1.3.0fileactivityActionId":{"id":"components/schemas/ocsfv1.3.0fileactivityActionId","kind":"json-schema","title":"ocsfv1.3.0fileactivityActionId","data":{"title":"ocsfv1.3.0fileactivityActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Count', 'Uncorrected', 'Isolated', 'Quarantined' or 'Exonerated'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action was not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0fileactivityActivityId":{"id":"components/schemas/ocsfv1.3.0fileactivityActivityId","kind":"json-schema","title":"ocsfv1.3.0fileactivityActivityId","data":{"title":"ocsfv1.3.0fileactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Create: A request to create a new file on a file system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Read: A request to read data from a file on a file system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Update: A request to write data to a file on a file system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Delete: A request to delete a file on a file system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Rename: A request to rename a file on a file system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - SetAttributes: A request to set attributes for a file on a file system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - SetSecurity: A request to set security for a file on a file system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - GetAttributes: A request to get attributes for a file on a file system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - GetSecurity: A request to get security for a file on a file system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Encrypt: A request to encrypt a file on a file system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Decrypt: A request to decrypt a file on a file system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - Mount: A request to mount a file on a file system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Unmount: A request to unmount a file from a file system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Open: A request to create a file handle."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0fileactivityCategoryUid":{"id":"components/schemas/ocsfv1.3.0fileactivityCategoryUid","kind":"json-schema","title":"ocsfv1.3.0fileactivityCategoryUid","data":{"title":"ocsfv1.3.0fileactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n1 - SystemActivity: System Activity events."}},"components/schemas/ocsfv1.3.0fileactivityClassUid":{"id":"components/schemas/ocsfv1.3.0fileactivityClassUid","kind":"json-schema","title":"ocsfv1.3.0fileactivityClassUid","data":{"title":"ocsfv1.3.0fileactivityClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n1001 - FileSystemActivity: File System Activity events report when a process performs an action on a file or folder."}},"components/schemas/ocsfv1.3.0fileactivityDispositionId":{"id":"components/schemas/ocsfv1.3.0fileactivityDispositionId","kind":"json-schema","title":"ocsfv1.3.0fileactivityDispositionId","data":{"title":"ocsfv1.3.0fileactivityDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0fileactivityFileActivity":{"id":"components/schemas/ocsfv1.3.0fileactivityFileActivity","kind":"json-schema","title":"ocsfv1.3.0fileactivityFileActivity","data":{"title":"ocsfv1.3.0fileactivityFileActivity","type":"object","description":"File System Activity events report when a process performs an action on a file or folder.","properties":{"access_mask":{"type":"integer","nullable":true,"description":"The access mask in a platform-native format."},"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.3.0fileactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. Dispositions conform to an action of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed' or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Denied' in most cases. Note that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"99"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Other' is not an option. No action would equate to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0fileactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The actor that performed the activity on the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"file"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object"},"children":[],"type":"text"}],"type":"paragraph"}]},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects describing the tactics, techniques & sub-techniques identified by a security control or finding."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"System Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0fileactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0fileactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"component":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The name or relative pathname of a sub-component of the data object, if applicable. "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"attachment.doc"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"attachment.zip/bad.doc"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"part.mime/part.cab/part.uue/part.doc"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"."},"children":[],"type":"text"}]},"connection_uid":{"type":"string","nullable":true,"description":"The network connection identifier."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"create_mask":{"type":"string","nullable":true,"description":"The original Windows mask that is required to create the object."},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","description":"An addressable device, computer system or host."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.3.0fileactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"file":{"$ref":"#/components/schemas/ocsfv1.3.0File","description":"The file that is the target of the activity."},"file_diff":{"type":"string","nullable":true,"description":"File content differences used for change detection. For example, a common use case is to identify itemized changes within INI or configuration/property setting values."},"file_result":{"$ref":"#/components/schemas/ocsfv1.3.0File","nullable":true,"description":"The resulting file object when the activity was allowed and successful."},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.3.0FirewallRule","nullable":true,"description":"The firewall rule that triggered the event."},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0fileactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0fileactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0fileactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","actor","category_uid","class_uid","device","file","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0fileactivitySeverityId":{"id":"components/schemas/ocsfv1.3.0fileactivitySeverityId","kind":"json-schema","title":"ocsfv1.3.0fileactivitySeverityId","data":{"title":"ocsfv1.3.0fileactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0fileactivityStatusId":{"id":"components/schemas/ocsfv1.3.0fileactivityStatusId","kind":"json-schema","title":"ocsfv1.3.0fileactivityStatusId","data":{"title":"ocsfv1.3.0fileactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0fileactivityTypeUid":{"id":"components/schemas/ocsfv1.3.0fileactivityTypeUid","kind":"json-schema","title":"ocsfv1.3.0fileactivityTypeUid","data":{"title":"ocsfv1.3.0fileactivityTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n100100 - Unknown\n100101 - Create: A request to create a new file on a file system.\n100102 - Read: A request to read data from a file on a file system.\n100103 - Update: A request to write data to a file on a file system.\n100104 - Delete: A request to delete a file on a file system.\n100105 - Rename: A request to rename a file on a file system.\n100106 - SetAttributes: A request to set attributes for a file on a file system.\n100107 - SetSecurity: A request to set security for a file on a file system.\n100108 - GetAttributes: A request to get attributes for a file on a file system.\n100109 - GetSecurity: A request to get security for a file on a file system.\n100110 - Encrypt: A request to encrypt a file on a file system.\n100111 - Decrypt: A request to decrypt a file on a file system.\n100112 - Mount: A request to mount a file on a file system.\n100113 - Unmount: A request to unmount a file from a file system.\n100114 - Open: A request to create a file handle.\n100199 - Other"}},"components/schemas/ocsfv1.3.0groupmanagementActivityId":{"id":"components/schemas/ocsfv1.3.0groupmanagementActivityId","kind":"json-schema","title":"ocsfv1.3.0groupmanagementActivityId","data":{"title":"ocsfv1.3.0groupmanagementActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - AssignPrivileges: Assign privileges to a group."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - RevokePrivileges: Revoke privileges from a group."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - AddUser: Add user to a group."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - RemoveUser: Remove user from a group."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Delete: A group was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Create: A group was created."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0groupmanagementCategoryUid":{"id":"components/schemas/ocsfv1.3.0groupmanagementCategoryUid","kind":"json-schema","title":"ocsfv1.3.0groupmanagementCategoryUid","data":{"title":"ocsfv1.3.0groupmanagementCategoryUid","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CategoryUid is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - AccessManagement: Identity & Access Management (IAM) events relate to the supervision of the system's authentication and access control model. Examples of such events are the success or failure of authentication, granting of authority, password change, entity change, privileged use etc."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0groupmanagementClassUid":{"id":"components/schemas/ocsfv1.3.0groupmanagementClassUid","kind":"json-schema","title":"ocsfv1.3.0groupmanagementClassUid","data":{"title":"ocsfv1.3.0groupmanagementClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n3006 - GroupManagement: Group Management events report management updates to a group, including updates to membership and permissions."}},"components/schemas/ocsfv1.3.0groupmanagementGroupManagement":{"id":"components/schemas/ocsfv1.3.0groupmanagementGroupManagement","kind":"json-schema","title":"ocsfv1.3.0groupmanagementGroupManagement","data":{"title":"ocsfv1.3.0groupmanagementGroupManagement","type":"object","description":"Group Management events report management updates to a group, including updates to membership and permissions.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0groupmanagementActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Identity & Access Management"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0groupmanagementCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0groupmanagementClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"An addressable device, computer system or host."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"group":{"$ref":"#/components/schemas/ocsfv1.3.0Group","description":"Group that was the target of the event."},"http_request":{"$ref":"#/components/schemas/ocsfv1.3.0HttpRequest","nullable":true,"description":"Details about the underlying HTTP request."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"privileges":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of privileges assigned to the group."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"resource":{"$ref":"#/components/schemas/ocsfv1.3.0ResourceDetails","nullable":true,"description":"Resource that the privileges give access to."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0groupmanagementSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"Details about the source of the IAM activity."},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0groupmanagementStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0groupmanagementTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"user":{"$ref":"#/components/schemas/ocsfv1.3.0User","nullable":true,"description":"A user that was added to or removed from the group."}},"required":["activity_id","category_uid","class_uid","group","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0groupmanagementSeverityId":{"id":"components/schemas/ocsfv1.3.0groupmanagementSeverityId","kind":"json-schema","title":"ocsfv1.3.0groupmanagementSeverityId","data":{"title":"ocsfv1.3.0groupmanagementSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0groupmanagementStatusId":{"id":"components/schemas/ocsfv1.3.0groupmanagementStatusId","kind":"json-schema","title":"ocsfv1.3.0groupmanagementStatusId","data":{"title":"ocsfv1.3.0groupmanagementStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0groupmanagementTypeUid":{"id":"components/schemas/ocsfv1.3.0groupmanagementTypeUid","kind":"json-schema","title":"ocsfv1.3.0groupmanagementTypeUid","data":{"title":"ocsfv1.3.0groupmanagementTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n300600 - Unknown\n300601 - AssignPrivileges: Assign privileges to a group.\n300602 - RevokePrivileges: Revoke privileges from a group.\n300603 - AddUser: Add user to a group.\n300604 - RemoveUser: Remove user from a group.\n300605 - Delete: A group was deleted.\n300606 - Create: A group was created.\n300699 - Other"}},"components/schemas/ocsfv1.3.0incidentfindingActivityId":{"id":"components/schemas/ocsfv1.3.0incidentfindingActivityId","kind":"json-schema","title":"ocsfv1.3.0incidentfindingActivityId","data":{"title":"ocsfv1.3.0incidentfindingActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Create: Reports the creation of an Incident."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Update: Reports updates to an Incident."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Close: Reports closure of an Incident ."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0incidentfindingCategoryUid":{"id":"components/schemas/ocsfv1.3.0incidentfindingCategoryUid","kind":"json-schema","title":"ocsfv1.3.0incidentfindingCategoryUid","data":{"title":"ocsfv1.3.0incidentfindingCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n2 - Findings: Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products."}},"components/schemas/ocsfv1.3.0incidentfindingClassUid":{"id":"components/schemas/ocsfv1.3.0incidentfindingClassUid","kind":"json-schema","title":"ocsfv1.3.0incidentfindingClassUid","data":{"title":"ocsfv1.3.0incidentfindingClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n2005 - IncidentFinding: An Incident Finding reports the creation, update, or closure of security incidents as a result of detections and/or analytics."}},"components/schemas/ocsfv1.3.0incidentfindingConfidenceId":{"id":"components/schemas/ocsfv1.3.0incidentfindingConfidenceId","kind":"json-schema","title":"ocsfv1.3.0incidentfindingConfidenceId","data":{"title":"ocsfv1.3.0incidentfindingConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0incidentfindingImpactId":{"id":"components/schemas/ocsfv1.3.0incidentfindingImpactId","kind":"json-schema","title":"ocsfv1.3.0incidentfindingImpactId","data":{"title":"ocsfv1.3.0incidentfindingImpactId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ImpactId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized impact is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The impact is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"impact"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0incidentfindingIncidentFinding":{"id":"components/schemas/ocsfv1.3.0incidentfindingIncidentFinding","kind":"json-schema","title":"ocsfv1.3.0incidentfindingIncidentFinding","data":{"title":"ocsfv1.3.0incidentfindingIncidentFinding","type":"object","description":"An Incident Finding reports the creation, update, or closure of security incidents as a result of detections and/or analytics.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0incidentfindingActivityId","description":"The normalized identifier of the Incident activity."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Incident activity name, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"assignee":{"$ref":"#/components/schemas/ocsfv1.3.0User","nullable":true,"description":"The details of the user assigned to an Incident."},"assignee_group":{"$ref":"#/components/schemas/ocsfv1.3.0Group","nullable":true,"description":"The details of the group assigned to an Incident."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects describing the tactics, techniques & sub-techniques associated to the Incident."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0incidentfindingCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0incidentfindingClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"comment":{"type":"string","nullable":true,"description":"Additional user supplied details for updating or closing the incident."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.3.0incidentfindingConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"desc":{"type":"string","nullable":true,"description":"The short description of the Incident."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time of the most recent event included in the incident."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the most recent event included in the incident."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"finding_info_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0FindingInfo"},"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects associated to an incident."},"children":[],"type":"text"}],"type":"paragraph"}]},"impact":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"impact_id":{"$ref":"#/components/schemas/ocsfv1.3.0incidentfindingImpactId","nullable":true,"description":"The normalized impact of the finding."},"impact_score":{"type":"integer","nullable":true,"description":"The impact of the finding, valid range 0-100."},"is_suspected_breach":{"type":"boolean","nullable":true,"description":"A determination based on analytics as to whether a potential breach was found."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"priority":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The priority, normalized to the caption of the priority_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"priority_id":{"$ref":"#/components/schemas/ocsfv1.3.0incidentfindingPriorityId","nullable":true,"description":"The normalized priority. Priority identifies the relative importance of the finding. It is a measurement of urgency."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0incidentfindingSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.3.0URLString","nullable":true,"description":"A Url link used to access the original incident."},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time of the least recent event included in the incident."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the least recent event included in the incident."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized status of the Incident normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0incidentfindingStatusId","description":"The normalized status identifier of the Incident."},"ticket":{"$ref":"#/components/schemas/ocsfv1.3.0Ticket","nullable":true,"description":"The linked ticket in the ticketing system."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0incidentfindingTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"verdict":{"type":"string","nullable":true,"description":"The verdict assigned to an Incident finding."},"verdict_id":{"$ref":"#/components/schemas/ocsfv1.3.0incidentfindingVerdictId","nullable":true,"description":"The normalized verdict of an Incident."}},"required":["activity_id","category_uid","class_uid","finding_info_list","metadata","severity_id","status_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0incidentfindingPriorityId":{"id":"components/schemas/ocsfv1.3.0incidentfindingPriorityId","kind":"json-schema","title":"ocsfv1.3.0incidentfindingPriorityId","data":{"title":"ocsfv1.3.0incidentfindingPriorityId","type":"integer","description":"PriorityId is an enum, and the following values are allowed.\n0 - Unknown: No priority is assigned.\n1 - Low: Application or personal procedure is unusable, where a workaround is available or a repair is possible.\n2 - Medium: Non-critical function or procedure is unusable or hard to use causing operational disruptions with no direct impact on a service's availability. A workaround is available.\n3 - High: Critical functionality or network access is interrupted, degraded or unusable, having a severe impact on services availability. No acceptable alternative is possible.\n4 - Critical: Interruption making a critical functionality inaccessible or a complete network interruption causing a severe impact on services availability. There is no possible alternative.\n99 - Other: The priority is not normalized."}},"components/schemas/ocsfv1.3.0incidentfindingSeverityId":{"id":"components/schemas/ocsfv1.3.0incidentfindingSeverityId","kind":"json-schema","title":"ocsfv1.3.0incidentfindingSeverityId","data":{"title":"ocsfv1.3.0incidentfindingSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0incidentfindingStatusId":{"id":"components/schemas/ocsfv1.3.0incidentfindingStatusId","kind":"json-schema","title":"ocsfv1.3.0incidentfindingStatusId","data":{"title":"ocsfv1.3.0incidentfindingStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - New: The service desk has received the incident but has not assigned it to an agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - InProgress: The incident has been assigned to an agent but has not been resolved. The agent is actively working with the user to diagnose and resolve the incident."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - OnHold: The incident requires some information or response from the user or from a third party."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Resolved: The service desk has confirmed that the incident is resolved."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Closed: The incident is resolved and no further action is necessary."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0incidentfindingTypeUid":{"id":"components/schemas/ocsfv1.3.0incidentfindingTypeUid","kind":"json-schema","title":"ocsfv1.3.0incidentfindingTypeUid","data":{"title":"ocsfv1.3.0incidentfindingTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n200500 - Unknown\n200501 - Create: Reports the creation of an Incident.\n200502 - Update: Reports updates to an Incident.\n200503 - Close: Reports closure of an Incident .\n200599 - Other"}},"components/schemas/ocsfv1.3.0incidentfindingVerdictId":{"id":"components/schemas/ocsfv1.3.0incidentfindingVerdictId","kind":"json-schema","title":"ocsfv1.3.0incidentfindingVerdictId","data":{"title":"ocsfv1.3.0incidentfindingVerdictId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"VerdictId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - FalsePositive: The incident is a false positive."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - TruePositive: The incident is a true positive."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Disregard: The incident can be disregarded as it is unimportant, an error or accident."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Suspicious: The incident is suspicious."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Benign: The incident is benign."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Test: The incident is a test."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - InsufficientData: The incident has insufficient data to make a verdict."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - SecurityRisk: The incident is a security risk."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - ManagedExternally: The incident remediation or required actions are managed externally."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Duplicate: The incident is a duplicate."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0inventoryinfoActivityId":{"id":"components/schemas/ocsfv1.3.0inventoryinfoActivityId","kind":"json-schema","title":"ocsfv1.3.0inventoryinfoActivityId","data":{"title":"ocsfv1.3.0inventoryinfoActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Log: The discovered information is via a log."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Collect: The discovered information is via a collection process."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0inventoryinfoCategoryUid":{"id":"components/schemas/ocsfv1.3.0inventoryinfoCategoryUid","kind":"json-schema","title":"ocsfv1.3.0inventoryinfoCategoryUid","data":{"title":"ocsfv1.3.0inventoryinfoCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects."}},"components/schemas/ocsfv1.3.0inventoryinfoClassUid":{"id":"components/schemas/ocsfv1.3.0inventoryinfoClassUid","kind":"json-schema","title":"ocsfv1.3.0inventoryinfoClassUid","data":{"title":"ocsfv1.3.0inventoryinfoClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n5001 - DeviceInventoryInfo: Device Inventory Info events report device inventory data that is either logged or proactively collected. For example, when collecting device information from a CMDB or running a network sweep of connected devices."}},"components/schemas/ocsfv1.3.0inventoryinfoInventoryInfo":{"id":"components/schemas/ocsfv1.3.0inventoryinfoInventoryInfo","kind":"json-schema","title":"ocsfv1.3.0inventoryinfoInventoryInfo","data":{"title":"ocsfv1.3.0inventoryinfoInventoryInfo","type":"object","description":"Device Inventory Info events report device inventory data that is either logged or proactively collected. For example, when collecting device information from a CMDB or running a network sweep of connected devices.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","description":"The device that is being discovered by an inventory process."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","device","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0inventoryinfoSeverityId":{"id":"components/schemas/ocsfv1.3.0inventoryinfoSeverityId","kind":"json-schema","title":"ocsfv1.3.0inventoryinfoSeverityId","data":{"title":"ocsfv1.3.0inventoryinfoSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0inventoryinfoStatusId":{"id":"components/schemas/ocsfv1.3.0inventoryinfoStatusId","kind":"json-schema","title":"ocsfv1.3.0inventoryinfoStatusId","data":{"title":"ocsfv1.3.0inventoryinfoStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0inventoryinfoTypeUid":{"id":"components/schemas/ocsfv1.3.0inventoryinfoTypeUid","kind":"json-schema","title":"ocsfv1.3.0inventoryinfoTypeUid","data":{"title":"ocsfv1.3.0inventoryinfoTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n500100 - Unknown\n500101 - Log: The discovered information is via a log.\n500102 - Collect: The discovered information is via a collection process.\n500199 - Other"}},"components/schemas/ocsfv1.3.0moduleactivityActionId":{"id":"components/schemas/ocsfv1.3.0moduleactivityActionId","kind":"json-schema","title":"ocsfv1.3.0moduleactivityActionId","data":{"title":"ocsfv1.3.0moduleactivityActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Count', 'Uncorrected', 'Isolated', 'Quarantined' or 'Exonerated'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action was not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0moduleactivityActivityId":{"id":"components/schemas/ocsfv1.3.0moduleactivityActivityId","kind":"json-schema","title":"ocsfv1.3.0moduleactivityActivityId","data":{"title":"ocsfv1.3.0moduleactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Load"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Unload"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0moduleactivityCategoryUid":{"id":"components/schemas/ocsfv1.3.0moduleactivityCategoryUid","kind":"json-schema","title":"ocsfv1.3.0moduleactivityCategoryUid","data":{"title":"ocsfv1.3.0moduleactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n1 - SystemActivity: System Activity events."}},"components/schemas/ocsfv1.3.0moduleactivityClassUid":{"id":"components/schemas/ocsfv1.3.0moduleactivityClassUid","kind":"json-schema","title":"ocsfv1.3.0moduleactivityClassUid","data":{"title":"ocsfv1.3.0moduleactivityClassUid","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ClassUid is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1005 - ModuleActivity: Module  Activity events report when a process loads or unloads the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"module"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0moduleactivityDispositionId":{"id":"components/schemas/ocsfv1.3.0moduleactivityDispositionId","kind":"json-schema","title":"ocsfv1.3.0moduleactivityDispositionId","data":{"title":"ocsfv1.3.0moduleactivityDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0moduleactivityModuleActivity":{"id":"components/schemas/ocsfv1.3.0moduleactivityModuleActivity","kind":"json-schema","title":"ocsfv1.3.0moduleactivityModuleActivity","data":{"title":"ocsfv1.3.0moduleactivityModuleActivity","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Module  Activity events report when a process loads or unloads the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"module"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.3.0moduleactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. Dispositions conform to an action of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed' or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Denied' in most cases. Note that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"99"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Other' is not an option. No action would equate to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0moduleactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The actor that loaded or unloaded the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"module"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects describing the tactics, techniques & sub-techniques identified by a security control or finding."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"System Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0moduleactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0moduleactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","description":"An addressable device, computer system or host."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.3.0moduleactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.3.0FirewallRule","nullable":true,"description":"The firewall rule that triggered the event."},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"module":{"$ref":"#/components/schemas/ocsfv1.3.0Module","description":"The module that was loaded or unloaded."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0moduleactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0moduleactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0moduleactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","actor","category_uid","class_uid","device","metadata","module","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0moduleactivitySeverityId":{"id":"components/schemas/ocsfv1.3.0moduleactivitySeverityId","kind":"json-schema","title":"ocsfv1.3.0moduleactivitySeverityId","data":{"title":"ocsfv1.3.0moduleactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0moduleactivityStatusId":{"id":"components/schemas/ocsfv1.3.0moduleactivityStatusId","kind":"json-schema","title":"ocsfv1.3.0moduleactivityStatusId","data":{"title":"ocsfv1.3.0moduleactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0moduleactivityTypeUid":{"id":"components/schemas/ocsfv1.3.0moduleactivityTypeUid","kind":"json-schema","title":"ocsfv1.3.0moduleactivityTypeUid","data":{"title":"ocsfv1.3.0moduleactivityTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n100500 - Unknown\n100501 - Load\n100502 - Unload\n100599 - Other"}},"components/schemas/ocsfv1.3.0networkactivityActionId":{"id":"components/schemas/ocsfv1.3.0networkactivityActionId","kind":"json-schema","title":"ocsfv1.3.0networkactivityActionId","data":{"title":"ocsfv1.3.0networkactivityActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Count', 'Uncorrected', 'Isolated', 'Quarantined' or 'Exonerated'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action was not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0networkactivityActivityId":{"id":"components/schemas/ocsfv1.3.0networkactivityActivityId","kind":"json-schema","title":"ocsfv1.3.0networkactivityActivityId","data":{"title":"ocsfv1.3.0networkactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Open: A new network connection was opened."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Close: The network connection was closed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Reset: The network connection was abnormally terminated or closed by a middle device like firewalls."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Fail: The network connection failed. For example a connection timeout or no route to host."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Refuse: The network connection was refused. For example an attempt to connect to a server port which is not open."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Traffic: Network traffic report."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Listen: A network endpoint began listening for new network connections."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0networkactivityCategoryUid":{"id":"components/schemas/ocsfv1.3.0networkactivityCategoryUid","kind":"json-schema","title":"ocsfv1.3.0networkactivityCategoryUid","data":{"title":"ocsfv1.3.0networkactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n4 - NetworkActivity: Network Activity events."}},"components/schemas/ocsfv1.3.0networkactivityClassUid":{"id":"components/schemas/ocsfv1.3.0networkactivityClassUid","kind":"json-schema","title":"ocsfv1.3.0networkactivityClassUid","data":{"title":"ocsfv1.3.0networkactivityClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n4001 - NetworkActivity: Network Activity events report network connection and traffic activity."}},"components/schemas/ocsfv1.3.0networkactivityDispositionId":{"id":"components/schemas/ocsfv1.3.0networkactivityDispositionId","kind":"json-schema","title":"ocsfv1.3.0networkactivityDispositionId","data":{"title":"ocsfv1.3.0networkactivityDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0networkactivityNetworkActivity":{"id":"components/schemas/ocsfv1.3.0networkactivityNetworkActivity","kind":"json-schema","title":"ocsfv1.3.0networkactivityNetworkActivity","data":{"title":"ocsfv1.3.0networkactivityNetworkActivity","type":"object","description":"Network Activity events report network connection and traffic activity.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.3.0networkactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. Dispositions conform to an action of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed' or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Denied' in most cases. Note that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"99"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Other' is not an option. No action would equate to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0networkactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"app_name":{"type":"string","nullable":true,"description":"The name of the application associated with the event or object."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects describing the tactics, techniques & sub-techniques identified by a security control or finding."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Network Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0networkactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0networkactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"connection_info":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkConnectionInfo","nullable":true,"description":"The network connection information."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"An addressable device, computer system or host."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.3.0networkactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","description":"The responder (server) in a network connection."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.3.0FirewallRule","nullable":true,"description":"The firewall rule that triggered the event."},"ja4_fingerprint_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Ja4Fingerprint"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of the JA4+ network fingerprints."},"children":[],"type":"text"}],"type":"paragraph"}]},"load_balancer":{"$ref":"#/components/schemas/ocsfv1.3.0LoadBalancer","nullable":true,"description":"The Load Balancer object contains information related to the device that is distributing incoming traffic to specified destinations."},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"proxy":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkProxy","nullable":true,"description":"The proxy (server) in a network connection."},"proxy_connection_info":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkConnectionInfo","nullable":true,"description":"The connection information from the proxy server to the remote server."},"proxy_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkProxy","nullable":true,"description":"The proxy (server) in a network connection."},"proxy_http_request":{"$ref":"#/components/schemas/ocsfv1.3.0HttpRequest","nullable":true,"description":"The HTTP Request from the proxy server to the remote server."},"proxy_http_response":{"$ref":"#/components/schemas/ocsfv1.3.0HttpResponse","nullable":true,"description":"The HTTP Response from the remote server to the proxy server."},"proxy_tls":{"$ref":"#/components/schemas/ocsfv1.3.0Tls","nullable":true,"description":"The TLS protocol negotiated between the proxy server and the remote server."},"proxy_traffic":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkTraffic","nullable":true,"description":"The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0networkactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"The initiator (client) of the network connection."},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0networkactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"tls":{"$ref":"#/components/schemas/ocsfv1.3.0Tls","nullable":true,"description":"The Transport Layer Security (TLS) attributes."},"traffic":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkTraffic","nullable":true,"description":"The network traffic refers to the amount of data moving across a network at a given point of time. Intended to be used alongside Network Connection."},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0networkactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"url":{"$ref":"#/components/schemas/ocsfv1.3.0Url","nullable":true,"description":"The URL details relevant to the network traffic."}},"required":["activity_id","category_uid","class_uid","dst_endpoint","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0networkactivitySeverityId":{"id":"components/schemas/ocsfv1.3.0networkactivitySeverityId","kind":"json-schema","title":"ocsfv1.3.0networkactivitySeverityId","data":{"title":"ocsfv1.3.0networkactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0networkactivityStatusId":{"id":"components/schemas/ocsfv1.3.0networkactivityStatusId","kind":"json-schema","title":"ocsfv1.3.0networkactivityStatusId","data":{"title":"ocsfv1.3.0networkactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0networkactivityTypeUid":{"id":"components/schemas/ocsfv1.3.0networkactivityTypeUid","kind":"json-schema","title":"ocsfv1.3.0networkactivityTypeUid","data":{"title":"ocsfv1.3.0networkactivityTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n400100 - Unknown\n400101 - Open: A new network connection was opened.\n400102 - Close: The network connection was closed.\n400103 - Reset: The network connection was abnormally terminated or closed by a middle device like firewalls.\n400104 - Fail: The network connection failed. For example a connection timeout or no route to host.\n400105 - Refuse: The network connection was refused. For example an attempt to connect to a server port which is not open.\n400106 - Traffic: Network traffic report.\n400107 - Listen: A network endpoint began listening for new network connections.\n400199 - Other"}},"components/schemas/ocsfv1.3.0Account":{"id":"components/schemas/ocsfv1.3.0Account","kind":"json-schema","title":"ocsfv1.3.0Account","data":{"title":"ocsfv1.3.0Account","type":"object","description":"The Account object contains details about the account that initiated or performed a specific activity within a system or application.","properties":{"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels/tags associated to the account."},"name":{"type":"string","nullable":true,"description":"The name of the account (e.g. GCP Account Name)."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0Account_TypeId","nullable":true,"description":"The normalized account type identifier."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the account (e.g. AWS Account ID)."}}}},"components/schemas/ocsfv1.3.0Account_TypeId":{"id":"components/schemas/ocsfv1.3.0Account_TypeId","kind":"json-schema","title":"ocsfv1.3.0Account_TypeId","data":{"title":"ocsfv1.3.0Account_TypeId","type":"integer","description":"AccountTypeId is an enum, and the following values are allowed.\n0 - Unknown: The account type is unknown.\n1 - LDAPAccount\n2 - WindowsAccount\n3 - AWSIAMUser\n4 - AWSIAMRole\n5 - GCPAccount\n6 - AzureADAccount\n7 - MacOSAccount\n8 - AppleAccount\n9 - LinuxAccount\n10 - AWSAccount\n99 - Other: The account type is not mapped."}},"components/schemas/ocsfv1.3.0Actor":{"id":"components/schemas/ocsfv1.3.0Actor","kind":"json-schema","title":"ocsfv1.3.0Actor","data":{"title":"ocsfv1.3.0Actor","type":"object","description":"The Actor object contains details about the user, role, application, service, or process that initiated or performed a specific activity.","properties":{"actor_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The actor type, normalized to the caption of the actor_type_id value. In the case of 'Other', it is defined by the data source."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor_type_id":{"$ref":"#/components/schemas/ocsfv1.3.0Actor_ActorTypeId","nullable":true,"description":"The normalized identifier of the actor type."},"app_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The client application or service that initiated the activity. This can be in conjunction with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"user"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present.  Note that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"app_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is distinct from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"process"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present."},"children":[],"type":"text"}],"type":"paragraph"}]},"app_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the client application or service that initiated the activity. This can be in conjunction with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"user"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present. Note that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"app_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is distinct from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"process.pid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"process.uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Group"},"nullable":true,"description":"Groups which are pertinent to the action. For example, the team name for Teams, where the user may not necessarily be a member of the group, but it is still relevant to the action taken."},"idp":{"$ref":"#/components/schemas/ocsfv1.3.0Idp","nullable":true,"description":"This object describes details about the Identity Provider used."},"invoked_by":{"type":"string","nullable":true,"description":"The name of the service that invoked the activity as described in the event."},"process":{"$ref":"#/components/schemas/ocsfv1.3.0Process","nullable":true,"description":"The process that initiated the activity."},"session":{"$ref":"#/components/schemas/ocsfv1.3.0Session","nullable":true,"description":"The user session from which the activity was initiated."},"user":{"$ref":"#/components/schemas/ocsfv1.3.0User","nullable":true,"description":"The user that initiated the activity or the user context from which the activity was initiated."}}}},"components/schemas/ocsfv1.3.0Actor_ActorTypeId":{"id":"components/schemas/ocsfv1.3.0Actor_ActorTypeId","kind":"json-schema","title":"ocsfv1.3.0Actor_ActorTypeId","data":{"title":"ocsfv1.3.0Actor_ActorTypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActorActorTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The actor type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Internal: Internal actor."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Guest: Guest actor."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Federated: Federated actor."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The actor type is not mapped. See the actor_type attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Advisory":{"id":"components/schemas/ocsfv1.3.0Advisory","kind":"json-schema","title":"ocsfv1.3.0Advisory","data":{"title":"ocsfv1.3.0Advisory","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Advisory object represents publicly disclosed cybersecurity vulnerabilities defined in a Security advisory. e.g. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Microsoft KB Article, Apple Security Advisory"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"avg_timespan":{"$ref":"#/components/schemas/ocsfv1.3.0Timespan","nullable":true,"description":"The average time to patch."},"bulletin":{"type":"string","nullable":true,"description":"The Advisory bulletin identifier."},"classification":{"type":"string","nullable":true,"description":"The vendors classification of the Advisory."},"created_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the Advisory record was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the Advisory record was created."},"desc":{"type":"string","nullable":true,"description":"A brief description of the Advisory Record."},"install_state":{"type":"string","nullable":true,"description":"The install state of the Advisory."},"install_state_id":{"$ref":"#/components/schemas/ocsfv1.3.0Advisory_InstallStateId","nullable":true,"description":"The normalized install state ID of the Advisory."},"is_superseded":{"type":"boolean","nullable":true,"description":"The Advisory has been replaced by another."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the Advisory record was last updated."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the Advisory record was last updated."},"os":{"$ref":"#/components/schemas/ocsfv1.3.0Os","nullable":true,"description":"The operating system the Advisory applies to."},"product":{"$ref":"#/components/schemas/ocsfv1.3.0Product","nullable":true,"description":"The product where the vulnerability was discovered."},"references":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of reference URLs with additional information about the vulnerabilities disclosed in the Advisory."},"related_cves":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Cve"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of Common Vulnerabilities and Exposures "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cve.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"(CVE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" identifiers related to the vulnerabilities disclosed in the Advisory."},"children":[],"type":"text"}],"type":"paragraph"}]},"related_cwes":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Cwe"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of Common Weakness Enumeration "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"(CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" identifiers related to the vulnerabilities disclosed in the Advisory."},"children":[],"type":"text"}],"type":"paragraph"}]},"size":{"type":"integer","nullable":true,"description":"The size in bytes for the Advisory. Usually populated for a KB Article patch."},"src_url":{"$ref":"#/components/schemas/ocsfv1.3.0URLString","nullable":true,"description":"The Advisory link from the source vendor."},"title":{"type":"string","nullable":true,"description":"A title or a brief phrase summarizing the Advisory."},"uid":{"type":"string","description":"The unique number assigned to the disclosed vulnerability."}},"required":["uid"]}},"components/schemas/ocsfv1.3.0Advisory_InstallStateId":{"id":"components/schemas/ocsfv1.3.0Advisory_InstallStateId","kind":"json-schema","title":"ocsfv1.3.0Advisory_InstallStateId","data":{"title":"ocsfv1.3.0Advisory_InstallStateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AdvisoryInstallStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized install state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Installed: The item is installed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - NotInstalled: The item is not installed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - InstalledPendingReboot: The item is installed pending reboot operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The install state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"install_state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0AffectedCode":{"id":"components/schemas/ocsfv1.3.0AffectedCode","kind":"json-schema","title":"ocsfv1.3.0AffectedCode","data":{"title":"ocsfv1.3.0AffectedCode","type":"object","description":"The Affected Code object describes details about a code block identified as vulnerable.","properties":{"end_line":{"type":"integer","nullable":true,"description":"The line number of the last line of code block identified as vulnerable."},"file":{"$ref":"#/components/schemas/ocsfv1.3.0File","description":"Details about the file that contains the affected code block."},"owner":{"$ref":"#/components/schemas/ocsfv1.3.0User","nullable":true,"description":"Details about the user that owns the affected file."},"remediation":{"$ref":"#/components/schemas/ocsfv1.3.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"start_line":{"type":"integer","nullable":true,"description":"The line number of the first line of code block identified as vulnerable."}},"required":["file"]}},"components/schemas/ocsfv1.3.0AffectedPackage":{"id":"components/schemas/ocsfv1.3.0AffectedPackage","kind":"json-schema","title":"ocsfv1.3.0AffectedPackage","data":{"title":"ocsfv1.3.0AffectedPackage","type":"object","description":"The Affected Package object describes details about a software package identified as affected by a vulnerability/vulnerabilities.","properties":{"architecture":{"type":"string","nullable":true,"description":"Architecture is a shorthand name describing the type of computer hardware the packaged software is meant to run on."},"cpe_name":{"type":"string","nullable":true,"description":"The Common Platform Enumeration (CPE) name for the software package."},"epoch":{"type":"integer","nullable":true,"description":"The software package epoch. Epoch is a way to define weighted dependencies based on version numbers."},"fixed_in_version":{"type":"string","nullable":true,"description":"The software package version in which a reported vulnerability was patched/fixed."},"hash":{"$ref":"#/components/schemas/ocsfv1.3.0Fingerprint","nullable":true,"description":"Cryptographic hash to identify the binary instance of a software component. This can include any component such file, package, or library."},"license":{"type":"string","nullable":true,"description":"The software license applied to this package."},"name":{"type":"string","description":"The software package name."},"package_manager":{"type":"string","nullable":true,"description":"The software packager manager utilized to manage a package on a system, e.g. npm, yum, dpkg etc."},"path":{"type":"string","nullable":true,"description":"The installation path of the affected package."},"purl":{"type":"string","nullable":true,"description":"A purl is a URL string used to identify and locate a software package in a mostly universal and uniform way across programming languages, package managers, packaging conventions, tools, APIs and databases."},"release":{"type":"string","nullable":true,"description":"Release is the number of times a version of the software has been packaged."},"remediation":{"$ref":"#/components/schemas/ocsfv1.3.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of software package, normalized to the caption of the type_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0AffectedPackage_TypeId","nullable":true,"description":"The type of software package."},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor who published the software package."},"version":{"type":"string","description":"The software package version."}},"required":["name","version"]}},"components/schemas/ocsfv1.3.0AffectedPackage_TypeId":{"id":"components/schemas/ocsfv1.3.0AffectedPackage_TypeId","kind":"json-schema","title":"ocsfv1.3.0AffectedPackage_TypeId","data":{"title":"ocsfv1.3.0AffectedPackage_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AffectedPackageTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Application: An application software package."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - OperatingSystem: An operating system software package."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Agent":{"id":"components/schemas/ocsfv1.3.0Agent","kind":"json-schema","title":"ocsfv1.3.0Agent","data":{"title":"ocsfv1.3.0Agent","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An Agent (also known as a Sensor) is typically installed on an Operating System (OS) and serves as a specialized software component that can be designed to monitor, detect, collect, archive, or take action. These activities and possible actions are defined by the upstream system controlling the Agent and its intended purpose. For instance, an Agent can include Endpoint Detection & Response (EDR) agents, backup/disaster recovery sensors, Application Performance Monitoring or profiling sensors, and similar software."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the agent or sensor. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AWS SSM Agent"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"policies":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Policy"},"nullable":true,"description":"Describes the various policies that may be applied or enforced by an agent or sensor. E.g., Conditional Access, prevention, auto-update, tamper protection, destination configuration, etc."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of the type_id value for the agent or sensor. In the case of 'Other' or 'Unknown', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0Agent_TypeId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized representation of an agent or sensor. E.g., EDR, vulnerability management, APM, backup & recovery, etc."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The UID of the agent or sensor, sometimes known as a Sensor ID or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"aid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid_alt":{"type":"string","nullable":true,"description":"An alternative or contextual identifier for the agent or sensor, such as a configuration, organization, or license UID."},"vendor_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The company or author who created the agent or sensor. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Crowdstrike"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The semantic version of the agent or sensor, e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"7.101.50.0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.3.0Agent_TypeId":{"id":"components/schemas/ocsfv1.3.0Agent_TypeId","kind":"json-schema","title":"ocsfv1.3.0Agent_TypeId","data":{"title":"ocsfv1.3.0Agent_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AgentTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool that provides similar threat detection, anti-malware, anti-ransomware, or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender for Endpoint, Wazuh."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that provides similar data classification, data loss detection, and/or data loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview, Symantec DLP."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Recovery: Any agent or sensor that provides backups, archival, or recovery capabilities. E.g., Azure Backup, AWS Backint Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Observability: Any agent or sensor that provides Application Performance Monitoring (APM), active tracing, profiling, or other observability use cases and optionally forwards the logs. E.g., New Relic Agent, Datadog Agent, Azure Monitor Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - VulnerabilityManagement: Any agent or sensor that provides vulnerability management or scanning capabilities. E.g., Qualys VMDR, Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party storage system such as a data lake or SIEM. E.g., Splunk Universal Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - MobileDeviceManagement: Any agent or sensor responsible for providing Mobile Device Management (MDM) or Mobile Enterprise Management (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - ConfigurationManagement: Any agent or sensor that provides configuration management of a device, such as scanning for software, license management, or applying configurations. E.g., AWS Systems Manager Agent, Flexera, ServiceNow MID Server."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - RemoteAccess: Any agent or sensor that provides remote access capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager Agent, Verkada Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Analytic":{"id":"components/schemas/ocsfv1.3.0Analytic","kind":"json-schema","title":"ocsfv1.3.0Analytic","data":{"title":"ocsfv1.3.0Analytic","type":"object","description":"The Analytic object contains details about the analytic technique used to analyze and derive insights from the data or information that led to the creation of a finding or conclusion.","properties":{"category":{"type":"string","nullable":true,"description":"The analytic category."},"desc":{"type":"string","nullable":true,"description":"The description of the analytic that generated the finding."},"name":{"type":"string","nullable":true,"description":"The name of the analytic that generated the finding."},"related_analytics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Object"},"nullable":true,"description":"Other analytics related to this analytic."},"type":{"type":"string","nullable":true,"description":"The analytic type."},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0Analytic_TypeId","description":"The analytic type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the analytic that generated the finding."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The analytic version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["type_id"]}},"components/schemas/ocsfv1.3.0Analytic_TypeId":{"id":"components/schemas/ocsfv1.3.0Analytic_TypeId","kind":"json-schema","title":"ocsfv1.3.0Analytic_TypeId","data":{"title":"ocsfv1.3.0Analytic_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AnalyticTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Rule: A Rule in security analytics refers to predefined criteria or conditions set to monitor, alert, or enforce policies, playing a crucial role in access control, threat detection, and regulatory compliance across security systems."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Behavioral: Behavioral analytics focus on monitoring and analyzing user or system actions to identify deviations from established patterns, aiding in the detection of insider threats, fraud, and advanced persistent threats (APTs)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Statistical: Statistical analytics pertains to analyzing data patterns and anomalies using statistical models to predict, detect, and respond to potential threats, enhancing overall security posture through informed decision-making."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - ML_DL_: Learning (ML/DL) encompasses techniques that can \"learn\" from known data to create analytics that generalize to new data. There may be a statistical component to these techniques, but it is not a requirement."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Fingerprinting: Fingerprinting is the technique of collecting detailed system data, including software versions and configurations, to enhance threat detection, data loss prevention (DLP), and endpoint detection and response (EDR) capabilities."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Tagging: Tagging refers to the practice of assigning labels or identifiers to data, users, assets, or activities to monitor, control access, and facilitate incident response across various security domains such as DLP and EDR."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - KeywordMatch: Keyword Match involves scanning content for specific terms to identify sensitive information, potential threats, or policy violations, aiding in DLP and compliance monitoring."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - RegularExpressions: Regular Expressions are used to define complex search patterns for identifying, validating, and extracting specific data sets or threats within digital content, enhancing DLP, EDR, and threat detection mechanisms."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - ExactDataMatch: Exact Data Match is a precise comparison technique used to detect the unauthorized use or exposure of specific, sensitive information, crucial for enforcing DLP policies and protecting against data breaches."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - PartialDataMatch: Partial Data Match involves identifying instances where segments of sensitive information or patterns match, facilitating nuanced DLP and threat detection without requiring complete data conformity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - IndexedDataMatch: Indexed Data Match refers to comparing content against a pre-compiled index of sensitive information to efficiently detect and prevent unauthorized access or breaches, streamlining DLP and compliance efforts."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Api":{"id":"components/schemas/ocsfv1.3.0Api","kind":"json-schema","title":"ocsfv1.3.0Api","data":{"title":"ocsfv1.3.0Api","type":"object","description":"The API, or Application Programming Interface, object represents  information pertaining to an API request and response.","properties":{"group":{"$ref":"#/components/schemas/ocsfv1.3.0Group","nullable":true,"description":"The information pertaining to the API group."},"operation":{"type":"string","description":"Verb/Operation associated with the request"},"request":{"$ref":"#/components/schemas/ocsfv1.3.0Request","nullable":true,"description":"Details pertaining to the API request."},"response":{"$ref":"#/components/schemas/ocsfv1.3.0Response","nullable":true,"description":"Details pertaining to the API response."},"service":{"$ref":"#/components/schemas/ocsfv1.3.0Service","nullable":true,"description":"The information pertaining to the API service."},"version":{"type":"string","nullable":true,"description":"The version of the API service."}},"required":["operation"]}},"components/schemas/ocsfv1.3.0Attack":{"id":"components/schemas/ocsfv1.3.0Attack","kind":"json-schema","title":"ocsfv1.3.0Attack","data":{"title":"ocsfv1.3.0Attack","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object describes the tactic, technique & sub-technique associated to an attack as defined in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"sub_technique":{"$ref":"#/components/schemas/ocsfv1.3.0SubTechnique","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Sub Technique object describes the sub technique ID and/or name associated to an attack, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"tactic":{"$ref":"#/components/schemas/ocsfv1.3.0Tactic","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Tactic object describes the tactic ID and/or name that is associated to an attack, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"tactics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Tactic"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Tactic object describes the tactic ID and/or tactic name that are associated with the attack technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"technique":{"$ref":"#/components/schemas/ocsfv1.3.0Technique","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Technique object describes the technique ID and/or name associated to an attack, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" version."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.3.0AuthFactor":{"id":"components/schemas/ocsfv1.3.0AuthFactor","kind":"json-schema","title":"ocsfv1.3.0AuthFactor","data":{"title":"ocsfv1.3.0AuthFactor","type":"object","description":"An Authentication Factor object describes a category of methods used for identity verification in an authentication attempt.","properties":{"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"Device used to complete an authentication request."},"email_addr":{"$ref":"#/components/schemas/ocsfv1.3.0EmailAddress","nullable":true,"description":"The email address used in an email-based authentication factor."},"factor_type":{"type":"string","nullable":true,"description":"The type of authentication factor used in an authentication attempt."},"factor_type_id":{"$ref":"#/components/schemas/ocsfv1.3.0AuthFactor_FactorTypeId","description":"The normalized identifier for the authentication factor."},"is_hotp":{"type":"boolean","nullable":true,"description":"Whether the authentication factor is an HMAC-based One-time Password (HOTP)."},"is_totp":{"type":"boolean","nullable":true,"description":"Whether the authentication factor is a Time-based One-time Password (TOTP)."},"phone_number":{"type":"string","nullable":true,"description":"The phone number used for a telephony-based authentication request."},"provider":{"type":"string","nullable":true,"description":"The name of provider for an authentication factor."},"security_questions":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The question(s) provided to user for a question-based authentication factor."}},"required":["factor_type_id"]}},"components/schemas/ocsfv1.3.0AuthFactor_FactorTypeId":{"id":"components/schemas/ocsfv1.3.0AuthFactor_FactorTypeId","kind":"json-schema","title":"ocsfv1.3.0AuthFactor_FactorTypeId","data":{"title":"ocsfv1.3.0AuthFactor_FactorTypeId","type":"integer","description":"AuthFactorFactorTypeId is an enum, and the following values are allowed.\n0 - Unknown\n1 - SMS: User receives and inputs a code sent to their mobile device via SMS text message.\n2 - SecurityQuestion: The user responds to a security question as part of a question-based authentication factor\n3 - PhoneCall: System calls the user's registered phone number and requires the user to answer and provide a response.\n4 - Biometric: Devices that verify identity-based on user's physical identifiers, such as fingerprint scanners or retina scanners.\n5 - PushNotification: Push notification is sent to user's registered device and requires the user to acknowledge.\n6 - HardwareToken: Physical device that generates a code to be used for authentication.\n7 - OTP: Application generates a one-time password (OTP) for use in authentication.\n8 - Email: A code or link is sent to a user's registered email address.\n9 - U2F: Typically involves a hardware token, which the user physically interacts with to authenticate.\n10 - WebAuthn: Web-based API that enables users to register devices as authentication factors.\n11 - Password: The user enters a password that they have previously established.\n99 - Other"}},"components/schemas/ocsfv1.3.0Authorization":{"id":"components/schemas/ocsfv1.3.0Authorization","kind":"json-schema","title":"ocsfv1.3.0Authorization","data":{"title":"ocsfv1.3.0Authorization","type":"object","description":"The Authorization Result object provides details about the authorization outcome and associated policies related to activity.","properties":{"decision":{"type":"string","nullable":true,"description":"Authorization Result/outcome, e.g. allowed, denied."},"policy":{"$ref":"#/components/schemas/ocsfv1.3.0Policy","nullable":true,"description":"Details about the Identity/Access management policies that are applicable."}}}},"components/schemas/ocsfv1.3.0AutonomousSystem":{"id":"components/schemas/ocsfv1.3.0AutonomousSystem","kind":"json-schema","title":"ocsfv1.3.0AutonomousSystem","data":{"title":"ocsfv1.3.0AutonomousSystem","type":"object","description":"An autonomous system (AS) is a collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators on behalf of a single administrative entity or domain that presents a common, clearly defined routing policy to the internet.","properties":{"name":{"type":"string","nullable":true,"description":"Organization name for the Autonomous System."},"number":{"type":"integer","nullable":true,"description":"Unique number that the AS is identified by."}}}},"components/schemas/ocsfv1.3.0Certificate":{"id":"components/schemas/ocsfv1.3.0Certificate","kind":"json-schema","title":"ocsfv1.3.0Certificate","data":{"title":"ocsfv1.3.0Certificate","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Digital Certificate, also known as a Public Key Certificate, object contains information about the ownership and usage of a public key. It serves as a means to establish trust in the authenticity and integrity of the public key and the associated entity. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Certificate/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:Certificate"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the certificate was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the certificate was created."},"expiration_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The expiration time of the certificate."},"expiration_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The expiration time of the certificate."},"fingerprints":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Fingerprint"},"description":"The fingerprint list of the certificate."},"is_self_signed":{"type":"boolean","nullable":true,"description":"Denotes whether a digital certificate is self-signed or signed by a known certificate authority (CA)."},"issuer":{"type":"string","description":"The certificate issuer distinguished name."},"serial_number":{"type":"string","description":"The serial number of the certificate used to create the digital signature."},"subject":{"type":"string","nullable":true,"description":"The certificate subject distinguished name."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the certificate."},"version":{"type":"string","nullable":true,"description":"The certificate version."}},"required":["fingerprints","issuer","serial_number"]}},"components/schemas/ocsfv1.3.0CisBenchmarkResult":{"id":"components/schemas/ocsfv1.3.0CisBenchmarkResult","kind":"json-schema","title":"ocsfv1.3.0CisBenchmarkResult","data":{"title":"ocsfv1.3.0CisBenchmarkResult","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CIS Benchmark Result object contains information as defined by the Center for Internet Security ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.cisecurity.org/cis-benchmarks/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CIS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") benchmark result. CIS Benchmarks are a collection of best practices for securely configuring IT systems, software, networks, and cloud infrastructure."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"desc":{"type":"string","nullable":true,"description":"The CIS benchmark description."},"name":{"type":"string","description":"The CIS benchmark name."},"remediation":{"$ref":"#/components/schemas/ocsfv1.3.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"rule":{"$ref":"#/components/schemas/ocsfv1.3.0Rule","nullable":true,"description":"The CIS benchmark rule."}},"required":["name"]}},"components/schemas/ocsfv1.3.0CisCsc":{"id":"components/schemas/ocsfv1.3.0CisCsc","kind":"json-schema","title":"ocsfv1.3.0CisCsc","data":{"title":"ocsfv1.3.0CisCsc","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CIS Critical Security Control (CSC) contains information as defined by the Center for Internet Security Critical Security Control "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.cisecurity.org/controls"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"(CIS CSC)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Prioritized set of actions to protect your organization and data from cyber-attack vectors."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"control":{"type":"string","description":"A Control is prescriptive, prioritized, and simplified set of best practices that one can use to strengthen their cybersecurity posture. e.g. AWS SecurityHub Controls, CIS Controls."},"version":{"type":"string","nullable":true,"description":"The CIS critical security control version."}},"required":["control"]}},"components/schemas/ocsfv1.3.0Cloud":{"id":"components/schemas/ocsfv1.3.0Cloud","kind":"json-schema","title":"ocsfv1.3.0Cloud","data":{"title":"ocsfv1.3.0Cloud","type":"object","description":"The Cloud object contains information about a cloud account such as AWS Account ID, regions, etc.","properties":{"account":{"$ref":"#/components/schemas/ocsfv1.3.0Account","nullable":true,"description":"The account object describes details about the account that was the source or target of the activity."},"org":{"$ref":"#/components/schemas/ocsfv1.3.0Organization","nullable":true,"description":"Organization and org unit relevant to the event or object."},"project_uid":{"type":"string","nullable":true,"description":"The unique identifier of a Cloud project."},"provider":{"type":"string","description":"The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc."},"region":{"type":"string","nullable":true,"description":"The name of the cloud region, as defined by the cloud provider."},"zone":{"type":"string","nullable":true,"description":"The availability zone in the cloud region, as defined by the cloud provider."}},"required":["provider"]}},"components/schemas/ocsfv1.3.0Compliance":{"id":"components/schemas/ocsfv1.3.0Compliance","kind":"json-schema","title":"ocsfv1.3.0Compliance","data":{"title":"ocsfv1.3.0Compliance","type":"object","description":"The Compliance object contains information about Industry and Regulatory Framework standards, controls and requirements.","properties":{"compliance_references":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0KbArticle"},"nullable":true,"description":"A list of sources of information or tools that help organizations understand, interpret, and implement compliance standards. They provide guidance, best practices, and examples."},"compliance_standards":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0KbArticle"},"nullable":true,"description":"A list of established guidelines or criteria that define specific requirements an organization must follow."},"control":{"type":"string","nullable":true,"description":"A Control is prescriptive, prioritized, and simplified set of best practices that one can use to strengthen their cybersecurity posture. e.g. AWS SecurityHub Controls, CIS Controls."},"requirements":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of requirements associated to a specific control in an industry or regulatory framework. e.g. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" NIST.800-53.r5 AU-10 "},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"standards":{"type":"array","items":{"type":"string"},"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Security standards are a set of criteria organizations can follow to protect sensitive and confidential information. e.g. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST SP 800-53, CIS AWS Foundations Benchmark v1.4.0, ISO/IEC 27001"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The resultant status of the compliance check  normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":"The resultant status code of the compliance check."},"status_detail":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The contextual description of the status, status_code values."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0Compliance_StatusId","nullable":true,"description":"The normalized status identifier of the compliance check."}},"required":["standards"]}},"components/schemas/ocsfv1.3.0Compliance_StatusId":{"id":"components/schemas/ocsfv1.3.0Compliance_StatusId","kind":"json-schema","title":"ocsfv1.3.0Compliance_StatusId","data":{"title":"ocsfv1.3.0Compliance_StatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ComplianceStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Pass: The compliance check passed for all the evaluated resources."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Warning: The compliance check did not yield a result due to missing information."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Fail: The compliance check failed for at least one of the evaluated resources."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Container":{"id":"components/schemas/ocsfv1.3.0Container","kind":"json-schema","title":"ocsfv1.3.0Container","data":{"title":"ocsfv1.3.0Container","type":"object","description":"The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.","properties":{"hash":{"$ref":"#/components/schemas/ocsfv1.3.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Commit hash of image created for docker or the SHA256 hash of the container. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"image":{"$ref":"#/components/schemas/ocsfv1.3.0Image","nullable":true,"description":"The container image used as a template to run the container."},"name":{"type":"string","nullable":true,"description":"The container name."},"network_driver":{"type":"string","nullable":true,"description":"The network driver used by the container. For example, bridge, overlay, host, none, etc."},"orchestrator":{"type":"string","nullable":true,"description":"The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift."},"pod_uuid":{"type":"string","nullable":true,"description":"The unique identifier of the pod (or equivalent) that the container is executing on."},"runtime":{"type":"string","nullable":true,"description":"The backend running the container, such as containerd or cri-o."},"size":{"type":"integer","nullable":true,"description":"The size of the container image."},"tag":{"type":"string","nullable":true,"description":"The tag used by the container. It can indicate version, format, OS."},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full container unique identifier for this instantiation of the container. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.3.0Cve":{"id":"components/schemas/ocsfv1.3.0Cve","kind":"json-schema","title":"ocsfv1.3.0Cve","data":{"title":"ocsfv1.3.0Cve","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Vulnerabilities and Exposures (CVE) object represents publicly disclosed cybersecurity vulnerabilities defined in CVE Program catalog ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cve.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVE"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"). There is one CVE Record for each vulnerability in the catalog."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE."},"cvss":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Cvss"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS object details Common Vulnerability Scoring System ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/cvss/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") scores from the advisory that are related to the vulnerability."},"children":[],"type":"text"}],"type":"paragraph"}]},"cwe":{"$ref":"#/components/schemas/ocsfv1.3.0Cwe","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CWE object represents a weakness in a software system that can be exploited by a threat actor to perform an attack. The CWE object is based on the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Common Weakness Enumeration (CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" catalog."},"children":[],"type":"text"}],"type":"paragraph"}]},"cwe_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Common Weakness Enumeration (CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" unique identifier. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CWE-787"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cwe_url":{"$ref":"#/components/schemas/ocsfv1.3.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Common Weakness Enumeration (CWE) definition URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://cwe.mitre.org/data/definitions/787.html"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"desc":{"type":"string","nullable":true,"description":"A brief description of the CVE Record."},"epss":{"$ref":"#/components/schemas/ocsfv1.3.0Epss","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Exploit Prediction Scoring System (EPSS) object describes the estimated probability a vulnerability will be exploited. EPSS is a community-driven effort to combine descriptive information about vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild. ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/epss/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"EPSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}]},"modified_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The Record Modified Date identifies when the CVE record was last updated."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The Record Modified Date identifies when the CVE record was last updated."},"product":{"$ref":"#/components/schemas/ocsfv1.3.0Product","nullable":true,"description":"The product where the vulnerability was discovered."},"references":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of reference URLs with additional information about the CVE Record."},"title":{"type":"string","nullable":true,"description":"A title or a brief phrase summarizing the CVE record."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The vulnerability type as selected from a large dropdown menu during CVE refinement."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"Most frequently used vulnerability types are: "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"DoS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Code Execution"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Overflow"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Memory Corruption"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Sql Injection"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"XSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Directory Traversal"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Http Response Splitting"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Bypass something"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Gain Information"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Gain Privileges"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"CSRF"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"File Inclusion"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":". For more information see "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.cvedetails.com/vulnerabilities-by-types.php"}},"children":[{"$$mdtype":"Node","attributes":{"content":"Vulnerabilities By Type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" distributions."},"children":[],"type":"text"}]},"uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Vulnerabilities and Exposures unique number assigned to a specific computer vulnerability. A CVE Identifier begins with 4 digits representing the year followed by a sequence of digits that acts as a unique identifier. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVE-2021-12345"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["uid"]}},"components/schemas/ocsfv1.3.0Cvss":{"id":"components/schemas/ocsfv1.3.0Cvss","kind":"json-schema","title":"ocsfv1.3.0Cvss","data":{"title":"ocsfv1.3.0Cvss","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Vulnerability Scoring System ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/cvss/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") object provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"base_score":{"type":"number","format":"double","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS base score. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"9.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"depth":{"$ref":"#/components/schemas/ocsfv1.3.0Cvss_Depth","nullable":true,"description":"The CVSS depth represents a depth of the equation used to calculate CVSS score."},"metrics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Metric"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Vulnerability Scoring System metrics. This attribute contains information on the CVE's impact. If the CVE has been analyzed, this attribute will contain any CVSSv2 or CVSSv3 information associated with the vulnerability. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{ {\"Access Vector\", \"Network\"}, {\"Access Complexity\", \"Low\"}, ...}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"overall_score":{"type":"number","format":"double","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS overall score, impacted by base, temporal, and environmental metrics. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"9.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"CVSS v2.0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Low (0.0 – 3.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Medium (4.0 – 6.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"High (7.0 – 10.0)"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"CVSS v3.0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"None (0.0)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Low (0.1 - 3.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Medium (4.0 - 6.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"High (7.0 - 8.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Critical (9.0 - 10.0)"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}]},"vector_string":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["base_score","version"]}},"components/schemas/ocsfv1.3.0Cvss_Depth":{"id":"components/schemas/ocsfv1.3.0Cvss_Depth","kind":"json-schema","title":"ocsfv1.3.0Cvss_Depth","data":{"title":"ocsfv1.3.0Cvss_Depth","type":"string","description":"CvssDepth is an enum, and the following values are allowed.\nBase - Base\nEnvironmental - Environmental\nTemporal - Temporal"}},"components/schemas/ocsfv1.3.0Cwe":{"id":"components/schemas/ocsfv1.3.0Cwe","kind":"json-schema","title":"ocsfv1.3.0Cwe","data":{"title":"ocsfv1.3.0Cwe","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CWE object represents a weakness in a software system that can be exploited by a threat actor to perform an attack. The CWE object is based on the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Common Weakness Enumeration (CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" catalog."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"caption":{"type":"string","nullable":true,"description":"The caption assigned to the Common Weakness Enumeration unique identifier."},"src_url":{"$ref":"#/components/schemas/ocsfv1.3.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"URL pointing to the CWE Specification. For more information see "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CWE."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Weakness Enumeration unique number assigned to a specific weakness. A CWE Identifier begins \"CWE\" followed by a sequence of digits that acts as a unique identifier. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CWE-123"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["uid"]}},"components/schemas/ocsfv1.3.0Database":{"id":"components/schemas/ocsfv1.3.0Database","kind":"json-schema","title":"ocsfv1.3.0Database","data":{"title":"ocsfv1.3.0Database","type":"object","description":"The database object is used for databases which are typically datastore services that contain an organized collection of structured and unstructured data or a types of data.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the database was known to have been created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the database was known to have been created."},"desc":{"type":"string","nullable":true,"description":"The description of the database."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Group"},"nullable":true,"description":"The group names to which the database belongs."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The most recent time when any changes, updates, or modifications were made within the database."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent time when any changes, updates, or modifications were made within the database."},"name":{"type":"string","nullable":true,"description":"The database name, ordinarily as assigned by a database administrator."},"size":{"type":"integer","nullable":true,"description":"The size of the database in bytes."},"type":{"type":"string","nullable":true,"description":"The database type."},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0Database_TypeId","description":"The normalized identifier of the database type."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the database."}},"required":["type_id"]}},"components/schemas/ocsfv1.3.0Database_TypeId":{"id":"components/schemas/ocsfv1.3.0Database_TypeId","kind":"json-schema","title":"ocsfv1.3.0Database_TypeId","data":{"title":"ocsfv1.3.0Database_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DatabaseTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Relational"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Network"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - ObjectOriented"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Centralized"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Operational"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - NoSQL"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Databucket":{"id":"components/schemas/ocsfv1.3.0Databucket","kind":"json-schema","title":"ocsfv1.3.0Databucket","data":{"title":"ocsfv1.3.0Databucket","type":"object","description":"The databucket object is a basic container that holds data, typically organized through the use of data partitions.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the databucket was known to have been created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the databucket was known to have been created."},"desc":{"type":"string","nullable":true,"description":"The description of the databucket."},"file":{"$ref":"#/components/schemas/ocsfv1.3.0File","nullable":true,"description":"A file within a databucket."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Group"},"nullable":true,"description":"The group names to which the databucket belongs."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The most recent time when any changes, updates, or modifications were made within the databucket."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent time when any changes, updates, or modifications were made within the databucket."},"name":{"type":"string","nullable":true,"description":"The databucket name."},"size":{"type":"integer","nullable":true,"description":"The size of the databucket in bytes."},"type":{"type":"string","nullable":true,"description":"The databucket type."},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0Databucket_TypeId","description":"The normalized identifier of the databucket type."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the databucket."}},"required":["type_id"]}},"components/schemas/ocsfv1.3.0Databucket_TypeId":{"id":"components/schemas/ocsfv1.3.0Databucket_TypeId","kind":"json-schema","title":"ocsfv1.3.0Databucket_TypeId","data":{"title":"ocsfv1.3.0Databucket_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DatabucketTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - S3"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - AzureBlob"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - GCPBucket"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Device":{"id":"components/schemas/ocsfv1.3.0Device","kind":"json-schema","title":"ocsfv1.3.0Device","data":{"title":"ocsfv1.3.0Device","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Device object represents an addressable computer system or host, which is typically connected to a computer network and participates in the transmission or processing of data within the computer network. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Host/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"agent_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Agent"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"agent"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects associated with a device, endpoint, or resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"autoscale_uid":{"type":"string","nullable":true,"description":"The unique identifier of the cloud autoscale configuration."},"boot_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time the system was booted."},"boot_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the system was booted."},"container":{"$ref":"#/components/schemas/ocsfv1.3.0Container","nullable":true,"description":"The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd."},"created_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the device was known to have been created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the device was known to have been created."},"desc":{"type":"string","nullable":true,"description":"The description of the device, ordinarily as reported by the operating system."},"domain":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network domain where the device resides. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"work.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"first_seen_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The initial discovery time of the device."},"first_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The initial discovery time of the device."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Group"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The group names to which the device belongs. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[\"Windows Laptops\", \"Engineering\"]"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"hostname":{"$ref":"#/components/schemas/ocsfv1.3.0Hostname","nullable":true,"description":"The device hostname."},"hw_info":{"$ref":"#/components/schemas/ocsfv1.3.0DeviceHwInfo","nullable":true,"description":"The endpoint hardware information."},"hypervisor":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the hypervisor running on the device. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Xen"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"VMware"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Hyper-V"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"VirtualBox"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", etc."},"children":[],"type":"text"}],"type":"paragraph"}]},"image":{"$ref":"#/components/schemas/ocsfv1.3.0Image","nullable":true,"description":"The image used as a template to run the virtual machine."},"imei":{"type":"string","nullable":true,"description":"The International Mobile Station Equipment Identifier that is associated with the device."},"instance_uid":{"type":"string","nullable":true,"description":"The unique identifier of a VM instance."},"interface_name":{"type":"string","nullable":true,"description":"The name of the network interface (e.g. eth2)."},"interface_uid":{"type":"string","nullable":true,"description":"The unique identifier of the network interface."},"ip":{"$ref":"#/components/schemas/ocsfv1.3.0IPAddress","nullable":true,"description":"The device IP address, in either IPv4 or IPv6 format."},"ip_addresses":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of IP addresses available on the device"},"is_compliant":{"type":"boolean","nullable":true,"description":"The event occurred on a compliant device."},"is_managed":{"type":"boolean","nullable":true,"description":"The event occurred on a managed device."},"is_personal":{"type":"boolean","nullable":true,"description":"The event occurred on a personal device."},"is_trusted":{"type":"boolean","nullable":true,"description":"The event occurred on a trusted device."},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The most recent discovery time of the device."},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent discovery time of the device."},"location":{"$ref":"#/components/schemas/ocsfv1.3.0Location","nullable":true,"description":"The geographical location of the device."},"mac":{"$ref":"#/components/schemas/ocsfv1.3.0MACAddress","nullable":true,"description":"The Media Access Control (MAC) address of the endpoint."},"mac_addresses":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of MAC addresses available on the device"},"model":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The model of the device. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MacBook Pro"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"t3a.medium"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"modified_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the device was last known to have been modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the device was last known to have been modified."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The alternate device name, ordinarily as assigned by an administrator. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" could be any other string that helps to identify the device, such as a phone number; for example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"310-555-1234"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"namespace_pid":{"type":"integer","nullable":true,"description":"If running under a process namespace (such as in a container), the process identifier within that process namespace."},"netbios_names":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of NetBIOS names available on the device"},"network_interfaces":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkInterface"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network interfaces that are associated with the device, one for each unique MAC address/IP address/hostname/name combination."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" The first element of the array is the network information that pertains to the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"network_status":{"type":"string","nullable":true,"description":"The network isolation status of the endpoint"},"network_status_id":{"$ref":"#/components/schemas/ocsfv1.3.0Device_NetworkStatusId","nullable":true,"description":"The network isolation status ID."},"org":{"$ref":"#/components/schemas/ocsfv1.3.0Organization","nullable":true,"description":"Organization and org unit related to the device."},"os":{"$ref":"#/components/schemas/ocsfv1.3.0Os","nullable":true,"description":"The endpoint operating system."},"owner":{"$ref":"#/components/schemas/ocsfv1.3.0User","nullable":true,"description":"The identity of the service or user account that owns the endpoint or was last logged into it."},"region":{"type":"string","nullable":true,"description":"The region where the virtual machine is located. For example, an AWS Region."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.3.0Device_RiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"src_url":{"$ref":"#/components/schemas/ocsfv1.3.0URLString","nullable":true,"description":"The URL of the device in the event sources system."},"subnet":{"$ref":"#/components/schemas/ocsfv1.3.0Subnet","nullable":true,"description":"The subnet mask."},"subnet_uid":{"type":"string","nullable":true,"description":"The unique identifier of a virtual subnet."},"sw_info":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Product"},"nullable":true,"description":"The list of software contained on a device"},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The device type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"unknown"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"plc"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"scada"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dcs"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cnc"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"scientific"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"medical"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"lighting"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"energy"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"transportation"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0Device_TypeId","description":"The device type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the device. For example the Windows TargetSID or AWS EC2 ARN."},"uid_alt":{"type":"string","nullable":true,"description":"An alternate unique identifier of the device if any. For example the ActiveDirectory DN."},"vendor":{"$ref":"#/components/schemas/ocsfv1.3.0Organization","nullable":true,"description":"The product vendor that created the device."},"vendor_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The vendor for the device. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Dell"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Lenovo"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"vlan_uid":{"type":"string","nullable":true,"description":"The Virtual LAN identifier."},"vpc_uid":{"type":"string","nullable":true,"description":"The unique identifier of the Virtual Private Cloud (VPC)."},"zone":{"type":"string","nullable":true,"description":"The network zone or LAN segment."}},"required":["type_id"]}},"components/schemas/ocsfv1.3.0Device_NetworkStatusId":{"id":"components/schemas/ocsfv1.3.0Device_NetworkStatusId","kind":"json-schema","title":"ocsfv1.3.0Device_NetworkStatusId","data":{"title":"ocsfv1.3.0Device_NetworkStatusId","type":"integer","description":"DeviceNetworkStatusId is an enum, and the following values are allowed.\n1 - NotIsolated: Device is not isolated from the network.\n2 - Isolated: Device is isolated from the network.\n3 - PendingIsolation: Device is pending isolation from the network.\n4 - PendingRestore: Device is pending restoration from isolation.\n99 - Unknown: The network isolation status is unknown."}},"components/schemas/ocsfv1.3.0Device_RiskLevelId":{"id":"components/schemas/ocsfv1.3.0Device_RiskLevelId","kind":"json-schema","title":"ocsfv1.3.0Device_RiskLevelId","data":{"title":"ocsfv1.3.0Device_RiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DeviceRiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Device_TypeId":{"id":"components/schemas/ocsfv1.3.0Device_TypeId","kind":"json-schema","title":"ocsfv1.3.0Device_TypeId","data":{"title":"ocsfv1.3.0Device_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DeviceTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Server: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Server/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Desktop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Laptop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Tablet: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Mobile: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile phone"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Virtual: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual machine"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - IOT: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.techtarget.com/iotagenda/definition/IoT-device"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IOT (Internet of Things) device"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Browser: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Browser/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"web browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Firewall: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Firewall/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking firewall"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Switch: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Switch/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking switch"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Hub: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Ethernet_hub"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking hub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - Router: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Router/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking router"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - IDS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion detection system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - IPS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion prevention system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - LoadBalancer: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Load_balancing_(computing)"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Load Balancer device."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"89 - ImagingEquipment: Equipment for processing optical data, such as a camera."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"90 - PLC: A Programmable logic controller."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"91 - SCADA: A supervisory control and data acquisition system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"92 - DCS: A distributed control system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"93 - CNC: A computer numerical control system, including computerized machine tools."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"94 - ScientificEquipment: A piece of scientific equipment such as an oscilloscope or spectrometer."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"95 - MedicalDevice: A medical device such as an MRI machine or infusion pump."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"96 - LightingControls: A lighting control for internal or external applications."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"97 - EnergyMonitoringSystem: An energy monitoring, security or safety system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"98 - TransportationDevice: A transportation device or transportation supporting device."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0DeviceHwInfo":{"id":"components/schemas/ocsfv1.3.0DeviceHwInfo","kind":"json-schema","title":"ocsfv1.3.0DeviceHwInfo","data":{"title":"ocsfv1.3.0DeviceHwInfo","type":"object","description":"The Device Hardware Information object contains details and specifications of the physical components that make up a device. This information provides an overview of the hardware capabilities, configuration, and characteristics of the device.","properties":{"bios_date":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The BIOS date. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"03/31/16"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"bios_manufacturer":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The BIOS manufacturer. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LENOVO"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"bios_uid":{"type":"string","nullable":true,"description":"The BIOS UUID."},"bios_ver":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The BIOS version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LENOVO G5ETA2WW (2.62)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"chassis":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The chassis type describes the system enclosure or physical form factor. Such as the following examples for Windows "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Windows Chassis Types"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"cpu_bits":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cpu architecture, the number of bits used for addressing in memory. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"32"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"64"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_cores":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of processor cores in all installed processors. For Example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"42"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of physical processors on a system. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_speed":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The speed of the processor in Mhz. For Example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"4200"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The processor type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"x86 Family 6 Model 37 Stepping 5"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"desktop_display":{"$ref":"#/components/schemas/ocsfv1.3.0Display","nullable":true,"description":"The desktop display affiliated with the event"},"keyboard_info":{"$ref":"#/components/schemas/ocsfv1.3.0KeyboardInfo","nullable":true,"description":"The keyboard detailed information."},"ram_size":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The total amount of installed RAM, in Megabytes. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2048"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"serial_number":{"type":"string","nullable":true,"description":"The device manufacturer serial number."},"uuid":{"type":"string","nullable":true,"description":"The device manufacturer assigned universally unique hardware identifier. For example: The BIOS System UUID or the Apple IOPlatformUUID."},"vendor_name":{"type":"string","nullable":true,"description":"The device manufacturer."}}}},"components/schemas/ocsfv1.3.0DigitalSignature":{"id":"components/schemas/ocsfv1.3.0DigitalSignature","kind":"json-schema","title":"ocsfv1.3.0DigitalSignature","data":{"title":"ocsfv1.3.0DigitalSignature","type":"object","description":"The Digital Signature object contains information about the cryptographic mechanism used to verify the authenticity, integrity, and origin of the file or application.","properties":{"algorithm":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The digital signature algorithm used to create the signature, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"algorithm_id":{"$ref":"#/components/schemas/ocsfv1.3.0DigitalSignature_AlgorithmId","description":"The identifier of the normalized digital signature algorithm."},"certificate":{"$ref":"#/components/schemas/ocsfv1.3.0Certificate","nullable":true,"description":"The certificate object containing information about the digital certificate."},"created_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the digital signature was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the digital signature was created."},"developer_uid":{"type":"string","nullable":true,"description":"The developer ID on the certificate that signed the file."},"digest":{"$ref":"#/components/schemas/ocsfv1.3.0Fingerprint","nullable":true,"description":"The message digest attribute contains the fixed length message hash representation and the corresponding hashing algorithm information."},"state":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The digital signature state defines the signature state, normalized to the caption of 'state_id'. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"state_id":{"$ref":"#/components/schemas/ocsfv1.3.0DigitalSignature_StateId","nullable":true,"description":"The normalized identifier of the signature state."}},"required":["algorithm_id"]}},"components/schemas/ocsfv1.3.0DigitalSignature_AlgorithmId":{"id":"components/schemas/ocsfv1.3.0DigitalSignature_AlgorithmId","kind":"json-schema","title":"ocsfv1.3.0DigitalSignature_AlgorithmId","data":{"title":"ocsfv1.3.0DigitalSignature_AlgorithmId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DigitalSignatureAlgorithmId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The algorithm is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - DSA: Digital Signature Algorithm (DSA)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - ECDSA: Elliptic Curve Digital Signature Algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The algorithm is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"algorithm"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0DigitalSignature_StateId":{"id":"components/schemas/ocsfv1.3.0DigitalSignature_StateId","kind":"json-schema","title":"ocsfv1.3.0DigitalSignature_StateId","data":{"title":"ocsfv1.3.0DigitalSignature_StateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DigitalSignatureStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Valid: The digital signature is valid."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Expired: The digital signature is not valid due to expiration of certificate."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Revoked: The digital signature is invalid due to certificate revocation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Suspended: The digital signature is invalid due to certificate suspension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Pending: The digital signature state is pending."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Display":{"id":"components/schemas/ocsfv1.3.0Display","kind":"json-schema","title":"ocsfv1.3.0Display","data":{"title":"ocsfv1.3.0Display","type":"object","description":"The Display object contains information about the physical or virtual display connected to a computer system.","properties":{"color_depth":{"type":"integer","nullable":true,"description":"The numeric color depth."},"physical_height":{"type":"integer","nullable":true,"description":"The numeric physical height of display."},"physical_orientation":{"type":"integer","nullable":true,"description":"The numeric physical orientation of display."},"physical_width":{"type":"integer","nullable":true,"description":"The numeric physical width of display."},"scale_factor":{"type":"integer","nullable":true,"description":"The numeric scale factor of display."}}}},"components/schemas/ocsfv1.3.0DnsAnswer":{"id":"components/schemas/ocsfv1.3.0DnsAnswer","kind":"json-schema","title":"ocsfv1.3.0DnsAnswer","data":{"title":"ocsfv1.3.0DnsAnswer","type":"object","description":"The DNS Answer object represents a specific response provided by the Domain Name System (DNS) when querying for information about a domain or performing a DNS operation. It encapsulates the relevant details and data returned by the DNS server in response to a query.","properties":{"class":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The class of DNS data contained in this resource record. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.rfc-editor.org/rfc/rfc1035.txt"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC1035"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IN"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"flag_ids":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0DnsAnswer_FlagIds"},"nullable":true,"description":"The list of DNS answer header flag IDs."},"flags":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of DNS answer header flags."},"packet_uid":{"type":"integer","nullable":true,"description":"The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response."},"rdata":{"type":"string","description":"The data describing the DNS resource. The meaning of this data depends on the type and class of the resource record."},"ttl":{"type":"integer","nullable":true,"description":"The time interval that the resource record may be cached. Zero value means that the resource record can only be used for the transaction in progress, and should not be cached."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of data contained in this resource record. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.rfc-editor.org/rfc/rfc1035.txt"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC1035"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CNAME"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["rdata"]}},"components/schemas/ocsfv1.3.0DnsAnswer_FlagIds":{"id":"components/schemas/ocsfv1.3.0DnsAnswer_FlagIds","kind":"json-schema","title":"ocsfv1.3.0DnsAnswer_FlagIds","data":{"title":"ocsfv1.3.0DnsAnswer_FlagIds","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DnsAnswerFlagIds is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The flag is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - AuthoritativeAnswer"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - TruncatedResponse"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - RecursionDesired"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - RecursionAvailable"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - AuthenticData"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - CheckingDisabled"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The flag is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"flags"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0DnsQuery":{"id":"components/schemas/ocsfv1.3.0DnsQuery","kind":"json-schema","title":"ocsfv1.3.0DnsQuery","data":{"title":"ocsfv1.3.0DnsQuery","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The DNS query object represents a specific request made to the Domain Name System (DNS) to retrieve information about a domain or perform a DNS operation. This object encapsulates the necessary attributes and methods to construct and send DNS queries, specify the query type (e.g., A, AAAA, MX). Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:DNSLookup/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:DNSLookup"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"class":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The class of resource records being queried. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.rfc-editor.org/rfc/rfc1035.txt"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC1035"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IN"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"hostname":{"$ref":"#/components/schemas/ocsfv1.3.0Hostname","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hostname or domain being queried. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"www.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"opcode":{"type":"string","nullable":true,"description":"The DNS opcode specifies the type of the query message."},"opcode_id":{"$ref":"#/components/schemas/ocsfv1.3.0DnsQuery_OpcodeId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The DNS opcode ID specifies the normalized query message type as defined in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.rfc-editor.org/rfc/rfc5395.html"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-5395"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"packet_uid":{"type":"integer","nullable":true,"description":"The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of resource records being queried. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.rfc-editor.org/rfc/rfc1035.txt"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC1035"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: A, AAAA, CNAME, MX, and NS."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["hostname"]}},"components/schemas/ocsfv1.3.0DnsQuery_OpcodeId":{"id":"components/schemas/ocsfv1.3.0DnsQuery_OpcodeId","kind":"json-schema","title":"ocsfv1.3.0DnsQuery_OpcodeId","data":{"title":"ocsfv1.3.0DnsQuery_OpcodeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DnsQueryOpcodeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Query: Standard query"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - InverseQuery: Inverse query, obsolete"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Status: Server status request"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Reserved: Reserved, not used"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Notify: Zone change notification"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Update: Dynamic DNS update"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - DSOMessage: DNS Stateful Operations (DSO)"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The DNS Opcode is not defined by the RFC. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"opcode"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0DomainContact":{"id":"components/schemas/ocsfv1.3.0DomainContact","kind":"json-schema","title":"ocsfv1.3.0DomainContact","data":{"title":"ocsfv1.3.0DomainContact","type":"object","description":"The contact information related to a domain registration, e.g., registrant, administrator, abuse, billing, or technical contact.","properties":{"email_addr":{"$ref":"#/components/schemas/ocsfv1.3.0EmailAddress","nullable":true,"description":"The user's primary email address."},"location":{"$ref":"#/components/schemas/ocsfv1.3.0Location","nullable":true,"description":"Location details for the contract such as the city, state/province, country, etc."},"name":{"type":"string","nullable":true,"description":"The individual or organization name for the contact."},"phone_number":{"type":"string","nullable":true,"description":"The number associated with the phone."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Domain Contact type, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source"},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0DomainContact_TypeId","description":"The normalized domain contact type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the contact information, typically provided in WHOIS information."}},"required":["type_id"]}},"components/schemas/ocsfv1.3.0DomainContact_TypeId":{"id":"components/schemas/ocsfv1.3.0DomainContact_TypeId","kind":"json-schema","title":"ocsfv1.3.0DomainContact_TypeId","data":{"title":"ocsfv1.3.0DomainContact_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DomainContactTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Registrant: The contact information provided is for the domain registrant."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Administrative: The contact information provided is for the domain administrator."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Technical: The contact information provided is for the domain technical lead."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Billing: The contact information provided is for the domain billing lead."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Abuse: The contact information provided is for the domain abuse contact."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Email":{"id":"components/schemas/ocsfv1.3.0Email","kind":"json-schema","title":"ocsfv1.3.0Email","data":{"title":"ocsfv1.3.0Email","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Email object describes the email metadata such as sender, recipients, and direction. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Email/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:Email"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"bcc":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The BCC recipients of the email. Similar to cc field but for BCC recipients."},"cc":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0EmailAddress"},"nullable":true,"description":"The email header Cc values, as defined by RFC 5322."},"delivered_to":{"$ref":"#/components/schemas/ocsfv1.3.0EmailAddress","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Delivered-To"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" email header field."},"children":[],"type":"text"}],"type":"paragraph"}]},"files":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0File"},"nullable":true,"description":"The files that are part of the event or object."},"from":{"$ref":"#/components/schemas/ocsfv1.3.0EmailAddress","description":"The email header From values, as defined by RFC 5322."},"is_externally_viewable":{"type":"boolean","nullable":true,"description":"True if the email is viewable externally (presumably by external users)."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Labels associated with the object, such as security or sensitivity labels created by a scanning app."},"message_uid":{"type":"string","nullable":true,"description":"The email header Message-Id value, as defined by RFC 5322."},"raw_header":{"type":"string","nullable":true,"description":"The email authentication header."},"reply_to":{"$ref":"#/components/schemas/ocsfv1.3.0EmailAddress","nullable":true,"description":"The email header Reply-To values, as defined by RFC 5322."},"sender_mailbox_uid":{"type":"string","nullable":true,"description":"Unique ID of the sender mailbox. This is distinct from the sender's email address."},"size":{"type":"integer","nullable":true,"description":"The size in bytes of the email, including attachments."},"smtp_from":{"$ref":"#/components/schemas/ocsfv1.3.0EmailAddress","nullable":true,"description":"The value of the SMTP MAIL FROM command."},"smtp_to":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0EmailAddress"},"nullable":true,"description":"The value of the SMTP envelope RCPT TO command."},"subject":{"type":"string","nullable":true,"description":"The email header Subject value, as defined by RFC 5322."},"time_sent":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time at which the email was sent."},"time_sent_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time at which the email was sent."},"to":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0EmailAddress"},"description":"The email header To values, as defined by RFC 5322."},"uid":{"type":"string","nullable":true,"description":"The email unique identifier."},"x_originating_ip":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0IPAddress"},"nullable":true,"description":"The X-Originating-IP header identifying the emails originating IP address(es)."}},"required":["from","to"]}},"components/schemas/ocsfv1.3.0EmailAuth":{"id":"components/schemas/ocsfv1.3.0EmailAuth","kind":"json-schema","title":"ocsfv1.3.0EmailAuth","data":{"title":"ocsfv1.3.0EmailAuth","type":"object","description":"The Email Authentication object describes the Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC) attributes of an email.","properties":{"dkim":{"type":"string","nullable":true,"description":"The DomainKeys Identified Mail (DKIM) status of the email."},"dkim_domain":{"type":"string","nullable":true,"description":"The DomainKeys Identified Mail (DKIM) signing domain of the email."},"dkim_signature":{"type":"string","nullable":true,"description":"The DomainKeys Identified Mail (DKIM) signature used by the sending/receiving system."},"dmarc":{"type":"string","nullable":true,"description":"The Domain-based Message Authentication, Reporting and Conformance (DMARC) status of the email."},"dmarc_override":{"type":"string","nullable":true,"description":"The Domain-based Message Authentication, Reporting and Conformance (DMARC) override action."},"dmarc_policy":{"type":"string","nullable":true,"description":"The Domain-based Message Authentication, Reporting and Conformance (DMARC) policy status."},"spf":{"type":"string","nullable":true,"description":"The Sender Policy Framework (SPF) status of the email."}}}},"components/schemas/ocsfv1.3.0EndpointConnection":{"id":"components/schemas/ocsfv1.3.0EndpointConnection","kind":"json-schema","title":"ocsfv1.3.0EndpointConnection","data":{"title":"ocsfv1.3.0EndpointConnection","type":"object","description":"The Endpoint Connection object contains information detailing a connection attempt to an endpoint.","properties":{"code":{"type":"integer","nullable":true,"description":"A numerical response status code providing details about the connection."},"network_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"Provides characteristics of the network endpoint."}}}},"components/schemas/ocsfv1.3.0Enrichment":{"id":"components/schemas/ocsfv1.3.0Enrichment","kind":"json-schema","title":"ocsfv1.3.0Enrichment","data":{"title":"ocsfv1.3.0Enrichment","type":"object","description":"The Enrichment object provides inline enrichment data for specific attributes of interest within an event. It serves as a mechanism to enhance or supplement the information associated with the event by adding additional relevant details or context.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the enrichment data was generated."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the enrichment data was generated."},"data":{"description":"The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record."},"desc":{"type":"string","nullable":true,"description":"A long description of the enrichment data."},"name":{"type":"string","description":"The name of the attribute to which the enriched data pertains."},"provider":{"type":"string","nullable":true,"description":"The enrichment data provider name."},"reputation":{"$ref":"#/components/schemas/ocsfv1.3.0Reputation","nullable":true,"description":"The reputation of the enrichment data."},"short_desc":{"type":"string","nullable":true,"description":"A short description of the enrichment data."},"src_url":{"$ref":"#/components/schemas/ocsfv1.3.0URLString","nullable":true,"description":"The URL of the source of the enrichment data."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The enrichment type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"location"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"value":{"type":"string","description":"The value of the attribute to which the enriched data pertains."}},"required":["data","name","value"]}},"components/schemas/ocsfv1.3.0Epss":{"id":"components/schemas/ocsfv1.3.0Epss","kind":"json-schema","title":"ocsfv1.3.0Epss","data":{"title":"ocsfv1.3.0Epss","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Exploit Prediction Scoring System (EPSS) object describes the estimated probability a vulnerability will be exploited. EPSS is a community-driven effort to combine descriptive information about vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild. ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/epss/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"EPSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The timestamp indicating when the EPSS score was calculated."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp indicating when the EPSS score was calculated."},"percentile":{"type":"number","format":"double","nullable":true,"description":"The EPSS score's percentile representing relative importance and ranking of the score in the larger EPSS dataset."},"score":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The EPSS score representing the probability [0-1] of exploitation in the wild in the next 30 days (following score publication)."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":"The version of the EPSS model used to calculate the score."}},"required":["score"]}},"components/schemas/ocsfv1.3.0Evidences":{"id":"components/schemas/ocsfv1.3.0Evidences","kind":"json-schema","title":"ocsfv1.3.0Evidences","data":{"title":"ocsfv1.3.0Evidences","type":"object","description":"A collection of evidence artifacts associated to the activity/activities that triggered a security detection.","properties":{"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"Describes details about the user/role/process that was the source of the activity that triggered the detection."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about the API call associated to the activity that triggered the detection."},"connection_info":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkConnectionInfo","nullable":true,"description":"Describes details about the network connection associated to the activity that triggered the detection."},"container":{"$ref":"#/components/schemas/ocsfv1.3.0Container","nullable":true,"description":"Describes details about the container associated to the activity that triggered the detection."},"data":{"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Additional evidence data that is not accounted for in the specific evidence attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Use only when absolutely necessary."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"database":{"$ref":"#/components/schemas/ocsfv1.3.0Database","nullable":true,"description":"Describes details about the database associated to the activity that triggered the detection."},"databucket":{"$ref":"#/components/schemas/ocsfv1.3.0Databucket","nullable":true,"description":"Describes details about the databucket associated to the activity that triggered the detection."},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"An addressable device, computer system or host associated to the activity that triggered the detection."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"Describes details about the destination of the network activity that triggered the detection."},"email":{"$ref":"#/components/schemas/ocsfv1.3.0Email","nullable":true,"description":"The email object associated to the activity that triggered the detection."},"file":{"$ref":"#/components/schemas/ocsfv1.3.0File","nullable":true,"description":"Describes details about the file associated to the activity that triggered the detection."},"job":{"$ref":"#/components/schemas/ocsfv1.3.0Job","nullable":true,"description":"Describes details about the scheduled job that was associated with the activity that triggered the detection."},"process":{"$ref":"#/components/schemas/ocsfv1.3.0Process","nullable":true,"description":"Describes details about the process associated to the activity that triggered the detection."},"query":{"$ref":"#/components/schemas/ocsfv1.3.0DnsQuery","nullable":true,"description":"Describes details about the DNS query associated to the activity that triggered the detection."},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"Describes details about the source of the network activity that triggered the detection."},"url":{"$ref":"#/components/schemas/ocsfv1.3.0Url","nullable":true,"description":"The URL object that pertains to the event or object associated to the activity that triggered the detection."},"user":{"$ref":"#/components/schemas/ocsfv1.3.0User","nullable":true,"description":"Describes details about the user that was the target or somehow else associated with the activity that triggered the detection."}}}},"components/schemas/ocsfv1.3.0Extension":{"id":"components/schemas/ocsfv1.3.0Extension","kind":"json-schema","title":"ocsfv1.3.0Extension","data":{"title":"ocsfv1.3.0Extension","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The OCSF Schema Extension object provides detailed information about the schema extension used to construct the event. The schema extensions are registered in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://github.com/ocsf/ocsf-schema/blob/main/extensions.md"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"extensions.md"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" file."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The schema extension name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dev"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The schema extension unique identifier. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"999"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The schema extension version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.0.0-alpha.2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["name","uid","version"]}},"components/schemas/ocsfv1.3.0Feature":{"id":"components/schemas/ocsfv1.3.0Feature","kind":"json-schema","title":"ocsfv1.3.0Feature","data":{"title":"ocsfv1.3.0Feature","type":"object","description":"The Feature object provides information about the software product feature that generated a specific event. It encompasses details related to the capabilities, components, user interface (UI) design, and performance upgrades associated with the feature.","properties":{"name":{"type":"string","nullable":true,"description":"The name of the feature."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the feature."},"version":{"type":"string","nullable":true,"description":"The version of the feature."}}}},"components/schemas/ocsfv1.3.0File":{"id":"components/schemas/ocsfv1.3.0File","kind":"json-schema","title":"ocsfv1.3.0File","data":{"title":"ocsfv1.3.0File","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The File object represents the metadata associated with a file stored in a computer system. It encompasses information about the file itself, including its attributes, properties, and organizational details. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://next.d3fend.mitre.org/dao/artifact/d3f:File/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:File"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"accessed_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the file was last accessed."},"accessed_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the file was last accessed."},"accessor":{"$ref":"#/components/schemas/ocsfv1.3.0User","nullable":true,"description":"The name of the user who last accessed the object."},"accessor_app":{"$ref":"#/components/schemas/ocsfv1.3.0Product","nullable":true,"description":"The app which mediated access to the file. This could be separate from the source app, for example a case where a user exports a report from a web app. The source app would be their browser and the accessor app the web app."},"attributes":{"type":"integer","nullable":true,"description":"The bitmask value that represents the file attributes."},"company_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the company that published the file. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Microsoft Corporation"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidentiality":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidentiality_id":{"$ref":"#/components/schemas/ocsfv1.3.0File_ConfidentialityId","nullable":true,"description":"The normalized identifier of the file content confidentiality indicator."},"created_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the file was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the file was created."},"creator":{"$ref":"#/components/schemas/ocsfv1.3.0User","nullable":true,"description":"The user that created the file."},"desc":{"type":"string","nullable":true,"description":"The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type."},"ext":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The extension of the file, excluding the leading dot. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"svchost.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"gz"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"export.tar.gz"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"hashes":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Fingerprint"},"nullable":true,"description":"An array of hash attributes."},"is_system":{"type":"boolean","nullable":true,"description":"The indication of whether the object is part of the operating system."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Labels associated with the object, such as security or sensitivity labels created by a scanning app."},"mime_type":{"type":"string","nullable":true,"description":"The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the file was last modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the file was last modified."},"modifier":{"$ref":"#/components/schemas/ocsfv1.3.0User","nullable":true,"description":"The user that last modified the file."},"name":{"$ref":"#/components/schemas/ocsfv1.3.0FileName","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the file. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"svchost.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"owner":{"$ref":"#/components/schemas/ocsfv1.3.0User","nullable":true,"description":"The user that owns the file/object."},"parent_folder":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The parent folder in which the file resides. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"c:\\windows\\system32"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"path":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full path to the file. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"c:\\windows\\system32\\svchost.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"product":{"$ref":"#/components/schemas/ocsfv1.3.0Product","nullable":true,"description":"The product that created or installed the file."},"security_descriptor":{"type":"string","nullable":true,"description":"The object security descriptor."},"signature":{"$ref":"#/components/schemas/ocsfv1.3.0DigitalSignature","nullable":true,"description":"The digital signature of the file."},"size":{"type":"integer","nullable":true,"description":"The size of data, in bytes."},"type":{"type":"string","nullable":true,"description":"The file type."},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0File_TypeId","description":"The file type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the file as defined by the storage system, such the file system file ID."},"url":{"$ref":"#/components/schemas/ocsfv1.3.0Url","nullable":true,"description":"The URL object that pertains to the event or object. See specific usage."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The file version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"8.0.7601.17514"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"xattributes":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An unordered collection of zero or more name/value pairs where each pair represents a file or folder extended attribute."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example: Windows alternate data stream attributes (ADS stream name, ADS size, etc.), user-defined or application-defined attributes, ACL, owner, primary group, etc. Examples from DCS: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ads_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ads_size"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dacl"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"owner"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"primary_group"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"link_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" - name of the link associated to the file."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"hard_link_count"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" - the number of links that are associated to the file."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"required":["name","type_id"]}},"components/schemas/ocsfv1.3.0File_ConfidentialityId":{"id":"components/schemas/ocsfv1.3.0File_ConfidentialityId","kind":"json-schema","title":"ocsfv1.3.0File_ConfidentialityId","data":{"title":"ocsfv1.3.0File_ConfidentialityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FileConfidentialityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The confidentiality is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - NotConfidential"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Confidential"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Secret"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - TopSecret"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Private"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Restricted"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidentiality is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidentiality"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0File_TypeId":{"id":"components/schemas/ocsfv1.3.0File_TypeId","kind":"json-schema","title":"ocsfv1.3.0File_TypeId","data":{"title":"ocsfv1.3.0File_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FileTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - RegularFile"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Folder"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - CharacterDevice"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - BlockDevice"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - LocalSocket"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - NamedPipe"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - SymbolicLink"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Finding":{"id":"components/schemas/ocsfv1.3.0Finding","kind":"json-schema","title":"ocsfv1.3.0Finding","data":{"title":"ocsfv1.3.0Finding","type":"object","description":"The Finding object describes metadata related to a security finding generated by a security tool or system.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the finding was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the finding was created."},"desc":{"type":"string","nullable":true,"description":"The description of the reported finding."},"first_seen_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the finding was first observed."},"first_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the finding was first observed."},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the finding was most recently observed."},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the finding was most recently observed."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the finding was last modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the finding was last modified."},"product_uid":{"type":"string","nullable":true,"description":"The unique identifier of the product that reported the finding."},"related_events":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0RelatedEvent"},"nullable":true,"description":"Describes events and/or other findings related to the finding as identified by the security product."},"remediation":{"$ref":"#/components/schemas/ocsfv1.3.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"src_url":{"$ref":"#/components/schemas/ocsfv1.3.0URLString","nullable":true,"description":"The URL pointing to the source of the finding."},"supporting_data":{"nullable":true,"description":"Additional data supporting a finding as provided by security tool"},"title":{"type":"string","description":"A title or a brief phrase summarizing the reported finding."},"types":{"type":"array","items":{"type":"string"},"nullable":true,"description":"One or more types of the reported finding."},"uid":{"type":"string","description":"The unique identifier of the reported finding."},"xattributes":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"An unordered collection of zero or more name/value pairs that represent a finding's extended attributes and are specific to the event source."}},"required":["title","uid"]}},"components/schemas/ocsfv1.3.0FindingInfo":{"id":"components/schemas/ocsfv1.3.0FindingInfo","kind":"json-schema","title":"ocsfv1.3.0FindingInfo","data":{"title":"ocsfv1.3.0FindingInfo","type":"object","description":"The Finding Information object describes metadata related to a security finding generated by a security tool or system.","properties":{"analytic":{"$ref":"#/components/schemas/ocsfv1.3.0Analytic","nullable":true,"description":"The analytic technique used to analyze and derive insights from the data or information that led to the finding or conclusion."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" technique and associated tactics related to the finding."},"children":[],"type":"text"}],"type":"paragraph"}]},"created_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the finding was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the finding was created."},"data_sources":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of data sources utilized in generation of the finding."},"desc":{"type":"string","nullable":true,"description":"The description of the reported finding."},"first_seen_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The time when the finding was first observed. e.g. The time when a vulnerability was first observed. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"It can differ from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"created_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" timestamp, which reflects the time this finding was created."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"first_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The time when the finding was first observed. e.g. The time when a vulnerability was first observed. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"It can differ from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"created_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" timestamp, which reflects the time this finding was created."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"kill_chain":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0KillChainPhase"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Cyber Kill Chain®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" provides a detailed description of each phase and its associated activities within the broader context of a cyber attack."},"children":[],"type":"text"}],"type":"paragraph"}]},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The time when the finding was most recently observed. e.g. The time when a vulnerability was most recently observed. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"It can differ from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"modified_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" timestamp, which reflects the time this finding was last modified."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The time when the finding was most recently observed. e.g. The time when a vulnerability was most recently observed. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"It can differ from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"modified_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" timestamp, which reflects the time this finding was last modified."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"modified_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the finding was last modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the finding was last modified."},"product_uid":{"type":"string","nullable":true,"description":"The unique identifier of the product that reported the finding."},"related_analytics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Analytic"},"nullable":true,"description":"Other analytics related to this finding."},"related_events":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0RelatedEvent"},"nullable":true,"description":"Describes events and/or other findings related to the finding as identified by the security product."},"src_url":{"$ref":"#/components/schemas/ocsfv1.3.0URLString","nullable":true,"description":"The URL pointing to the source of the finding."},"title":{"type":"string","description":"A title or a brief phrase summarizing the reported finding."},"types":{"type":"array","items":{"type":"string"},"nullable":true,"description":"One or more types of the reported finding."},"uid":{"type":"string","description":"The unique identifier of the reported finding."}},"required":["title","uid"]}},"components/schemas/ocsfv1.3.0Fingerprint":{"id":"components/schemas/ocsfv1.3.0Fingerprint","kind":"json-schema","title":"ocsfv1.3.0Fingerprint","data":{"title":"ocsfv1.3.0Fingerprint","type":"object","description":"The Fingerprint object provides detailed information about a digital fingerprint, which is a compact representation of data used to identify a longer piece of information, such as a public key or file content. It contains the algorithm and value of the fingerprint, enabling efficient and reliable identification of the associated data.","properties":{"algorithm":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"algorithm_id":{"$ref":"#/components/schemas/ocsfv1.3.0Fingerprint_AlgorithmId","description":"The identifier of the normalized hash algorithm, which was used to create the digital fingerprint."},"value":{"$ref":"#/components/schemas/ocsfv1.3.0Hash","description":"The digital fingerprint value."}},"required":["algorithm_id","value"]}},"components/schemas/ocsfv1.3.0Fingerprint_AlgorithmId":{"id":"components/schemas/ocsfv1.3.0Fingerprint_AlgorithmId","kind":"json-schema","title":"ocsfv1.3.0Fingerprint_AlgorithmId","data":{"title":"ocsfv1.3.0Fingerprint_AlgorithmId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FingerprintAlgorithmId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The algorithm is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context Triggered Piecewise Hash (CTPH)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - TLSH: The TLSH fuzzy hashing algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that works by XORing the bytes in a circular-shifting fashion."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The algorithm is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"algorithm"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0FirewallRule":{"id":"components/schemas/ocsfv1.3.0FirewallRule","kind":"json-schema","title":"ocsfv1.3.0FirewallRule","data":{"title":"ocsfv1.3.0FirewallRule","type":"object","description":"The Firewall Rule object represents a specific rule within a firewall policy or event. It contains information about a rule's configuration, properties, and associated actions that define how network traffic is handled by the firewall.","properties":{"category":{"type":"string","nullable":true,"description":"The rule category."},"condition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The rule trigger condition for the rule. For example: SQL_INJECTION."},"children":[],"type":"text"}],"type":"paragraph"}]},"desc":{"type":"string","nullable":true,"description":"The description of the rule that generated the event."},"duration":{"type":"integer","nullable":true,"description":"The rule response time duration, usually used for challenge completion time."},"match_details":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The data in a request that rule matched. For example: '[\"10\",\"and\",\"1\"]'."},"children":[],"type":"text"}],"type":"paragraph"}]},"match_location":{"type":"string","nullable":true,"description":"The location of the matched data in the source which resulted in the triggered firewall rule. For example: HEADER."},"name":{"type":"string","nullable":true,"description":"The name of the rule that generated the event."},"rate_limit":{"type":"integer","nullable":true,"description":"The rate limit for a rate-based rule."},"sensitivity":{"type":"string","nullable":true,"description":"The sensitivity of the firewall rule in the matched event. For example: HIGH."},"type":{"type":"string","nullable":true,"description":"The rule type."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the rule that generated the event."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The rule version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.3.0Group":{"id":"components/schemas/ocsfv1.3.0Group","kind":"json-schema","title":"ocsfv1.3.0Group","data":{"title":"ocsfv1.3.0Group","type":"object","description":"The Group object represents a collection or association of entities, such as users, policies, or devices. It serves as a logical grouping mechanism to organize and manage entities with similar characteristics or permissions within a system or organization.","properties":{"desc":{"type":"string","nullable":true,"description":"The group description."},"domain":{"type":"string","nullable":true,"description":"The domain where the group is defined. For example: the LDAP or Active Directory domain."},"email_addr":{"$ref":"#/components/schemas/ocsfv1.3.0EmailAddress","nullable":true,"description":"The group's email address. For example, a Google Group email address."},"name":{"type":"string","nullable":true,"description":"The group name."},"privileges":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The group privileges."},"type":{"type":"string","nullable":true,"description":"The type of the group or account."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group."}}}},"components/schemas/ocsfv1.3.0HttpHeader":{"id":"components/schemas/ocsfv1.3.0HttpHeader","kind":"json-schema","title":"ocsfv1.3.0HttpHeader","data":{"title":"ocsfv1.3.0HttpHeader","type":"object","description":"TThe HTTP Header object represents the headers sent in an HTTP request or response. HTTP headers are key-value pairs that convey additional information about the HTTP message, including details about the content, caching, authentication, encoding, and other aspects of the communication.","properties":{"name":{"type":"string","description":"The name of the header"},"value":{"type":"string","description":"The value of the header"}},"required":["name","value"]}},"components/schemas/ocsfv1.3.0HttpRequest":{"id":"components/schemas/ocsfv1.3.0HttpRequest","kind":"json-schema","title":"ocsfv1.3.0HttpRequest","data":{"title":"ocsfv1.3.0HttpRequest","type":"object","description":"The HTTP Request object represents the attributes of a request made to a web server. It encapsulates the details and metadata associated with an HTTP request, including the request method, headers, URL, query parameters, body content, and other relevant information.","properties":{"args":{"type":"string","nullable":true,"description":"The arguments sent along with the HTTP request."},"http_headers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0HttpHeader"},"nullable":true,"description":"Additional HTTP headers of an HTTP request or response."},"http_method":{"$ref":"#/components/schemas/ocsfv1.3.0HttpRequest_HttpMethod","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"HTTP request method"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" indicates the desired action to be performed for a given resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"length":{"type":"integer","nullable":true,"description":"The HTTP request length, in number of bytes."},"referrer":{"type":"string","nullable":true,"description":"The request header that identifies the address of the previous web page, which is linked to the current web page or resource being requested."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the http request."},"url":{"$ref":"#/components/schemas/ocsfv1.3.0Url","nullable":true,"description":"The URL object that pertains to the request."},"user_agent":{"type":"string","nullable":true,"description":"The request header that identifies the operating system and web browser."},"user_agent_name":{"type":"string","nullable":true,"description":"Concise version of the user agent, e.g. Chrome or Firefox instead of the full user-agent string."},"version":{"type":"string","nullable":true,"description":"The Hypertext Transfer Protocol (HTTP) version."},"x_forwarded_for":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0IPAddress"},"nullable":true,"description":"The X-Forwarded-For header identifying the originating IP address(es) of a client connecting to a web server through an HTTP proxy or a load balancer."}}}},"components/schemas/ocsfv1.3.0HttpRequest_HttpMethod":{"id":"components/schemas/ocsfv1.3.0HttpRequest_HttpMethod","kind":"json-schema","title":"ocsfv1.3.0HttpRequest_HttpMethod","data":{"title":"ocsfv1.3.0HttpRequest_HttpMethod","type":"string","description":"HttpRequestHttpMethod is an enum, and the following values are allowed.\nCONNECT - Connect: The CONNECT method establishes a tunnel to the server identified by the target resource.\nDELETE - Delete: The DELETE method deletes the specified resource.\nGET - Get: The GET method requests a representation of the specified resource. Requests using GET should only retrieve data.\nHEAD - Head: The HEAD method asks for a response identical to a GET request, but without the response body.\nOPTIONS - Options: The OPTIONS method describes the communication options for the target resource.\nPOST - Post: The POST method submits an entity to the specified resource, often causing a change in state or side effects on the server.\nPUT - Put: The PUT method replaces all current representations of the target resource with the request payload.\nTRACE - Trace: The TRACE method performs a message loop-back test along the path to the target resource."}},"components/schemas/ocsfv1.3.0HttpResponse":{"id":"components/schemas/ocsfv1.3.0HttpResponse","kind":"json-schema","title":"ocsfv1.3.0HttpResponse","data":{"title":"ocsfv1.3.0HttpResponse","type":"object","description":"The HTTP Response object contains detailed information about the response sent from a web server to the requester. It encompasses attributes and metadata that describe the response status, headers, body content, and other relevant information.","properties":{"code":{"type":"integer","description":"The Hypertext Transfer Protocol (HTTP) status code returned from the web server to the client. For example, 200."},"content_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The request header that identifies the original "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.iana.org/assignments/media-types/media-types.xhtml"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"media type "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the resource (prior to any content encoding applied for sending)."},"children":[],"type":"text"}],"type":"paragraph"}]},"http_headers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0HttpHeader"},"nullable":true,"description":"Additional HTTP headers of an HTTP request or response."},"latency":{"type":"integer","nullable":true,"description":"The HTTP response latency measured in milliseconds."},"length":{"type":"integer","nullable":true,"description":"The HTTP response length, in number of bytes."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"status":{"type":"string","nullable":true,"description":"The response status. For example: A successful HTTP status of 'OK' which corresponds to a code of 200."}},"required":["code"]}},"components/schemas/ocsfv1.3.0Idp":{"id":"components/schemas/ocsfv1.3.0Idp","kind":"json-schema","title":"ocsfv1.3.0Idp","data":{"title":"ocsfv1.3.0Idp","type":"object","description":"The Identity Provider object contains detailed information about a provider responsible for creating, maintaining, and managing identity information while offering authentication services to applications. An Identity Provider (IdP) serves as a trusted authority that verifies the identity of users and issues authentication tokens or assertions to enable secure access to applications or services.","properties":{"name":{"type":"string","nullable":true,"description":"The name of the identity provider."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the identity provider."}}}},"components/schemas/ocsfv1.3.0Image":{"id":"components/schemas/ocsfv1.3.0Image","kind":"json-schema","title":"ocsfv1.3.0Image","data":{"title":"ocsfv1.3.0Image","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Image object provides a description of a specific Virtual Machine (VM) or Container image. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:ContainerImage"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The image labels."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The image name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"elixir"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"path":{"type":"string","nullable":true,"description":"The full path to the image file."},"tag":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The image tag. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.11-alpine"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique image ID. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"77af4d6b9913"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["uid"]}},"components/schemas/ocsfv1.3.0Ja4Fingerprint":{"id":"components/schemas/ocsfv1.3.0Ja4Fingerprint","kind":"json-schema","title":"ocsfv1.3.0Ja4Fingerprint","data":{"title":"ocsfv1.3.0Ja4Fingerprint","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The JA4+ fingerprint object provides detailed fingerprint information about various aspects of network traffic which is both machine and human readable."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"section_a":{"type":"string","nullable":true,"description":"The 'a' section of the JA4 fingerprint."},"section_b":{"type":"string","nullable":true,"description":"The 'b' section of the JA4 fingerprint."},"section_c":{"type":"string","nullable":true,"description":"The 'c' section of the JA4 fingerprint."},"section_d":{"type":"string","nullable":true,"description":"The 'd' section of the JA4 fingerprint."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The JA4+ fingerprint type as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"href":"https://blog.foxio.io/ja4+-network-fingerprinting target="}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FoxIO"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", normalized to the caption of 'type_id'. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0Ja4Fingerprint_TypeId","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The identifier of the JA4+ fingerprint type."},"children":[],"type":"text"}],"type":"paragraph"}]},"value":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The JA4+ fingerprint value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["type_id","value"]}},"components/schemas/ocsfv1.3.0Ja4Fingerprint_TypeId":{"id":"components/schemas/ocsfv1.3.0Ja4Fingerprint_TypeId","kind":"json-schema","title":"ocsfv1.3.0Ja4Fingerprint_TypeId","data":{"title":"ocsfv1.3.0Ja4Fingerprint_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Ja4FingerprintTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - JA4: TLS Client Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - JA4Server: TLS Server Response/Session Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - JA4HTTP: HTTP Client Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - JA4Latency: Latency Measurement/Light Distance Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - JA4X509: X509 TLS Certificate Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - JA4SSH: SSH Traffic Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - JA4TCP: Passive TCP Client Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - JA4TCPServer: Passive TCP Server Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - JA4TCPScan: Active TCP Server Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Job":{"id":"components/schemas/ocsfv1.3.0Job","kind":"json-schema","title":"ocsfv1.3.0Job","data":{"title":"ocsfv1.3.0Job","type":"object","description":"The Job object provides information about a scheduled job or task, including its name, command line, and state. It encompasses attributes that describe the properties and status of the scheduled job.","properties":{"cmd_line":{"type":"string","nullable":true,"description":"The job command line."},"created_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the job was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the job was created."},"desc":{"type":"string","nullable":true,"description":"The description of the job."},"file":{"$ref":"#/components/schemas/ocsfv1.3.0File","description":"The file that pertains to the job."},"last_run_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the job was last run."},"last_run_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the job was last run."},"name":{"type":"string","description":"The name of the job."},"next_run_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the job will next be run."},"next_run_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the job will next be run."},"run_state":{"type":"string","nullable":true,"description":"The run state of the job."},"run_state_id":{"$ref":"#/components/schemas/ocsfv1.3.0Job_RunStateId","nullable":true,"description":"The run state ID of the job."},"user":{"$ref":"#/components/schemas/ocsfv1.3.0User","nullable":true,"description":"The user that created the job."}},"required":["file","name"]}},"components/schemas/ocsfv1.3.0Job_RunStateId":{"id":"components/schemas/ocsfv1.3.0Job_RunStateId","kind":"json-schema","title":"ocsfv1.3.0Job_RunStateId","data":{"title":"ocsfv1.3.0Job_RunStateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"JobRunStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The run state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Ready"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Queued"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Running"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Stopped"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The run state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"run_state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0KbArticle":{"id":"components/schemas/ocsfv1.3.0KbArticle","kind":"json-schema","title":"ocsfv1.3.0KbArticle","data":{"title":"ocsfv1.3.0KbArticle","type":"object","description":"The KB Article object contains metadata that describes the patch or update.","properties":{"avg_timespan":{"$ref":"#/components/schemas/ocsfv1.3.0Timespan","nullable":true,"description":"The average time to patch."},"bulletin":{"type":"string","nullable":true,"description":"The kb article bulletin identifier."},"classification":{"type":"string","nullable":true,"description":"The vendors classification of the kb article."},"created_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The date the kb article was released by the vendor."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The date the kb article was released by the vendor."},"install_state":{"type":"string","nullable":true,"description":"The install state of the kb article."},"install_state_id":{"$ref":"#/components/schemas/ocsfv1.3.0KbArticle_InstallStateId","nullable":true,"description":"The normalized install state ID of the kb article."},"is_superseded":{"type":"boolean","nullable":true,"description":"The kb article has been replaced by another."},"os":{"$ref":"#/components/schemas/ocsfv1.3.0Os","nullable":true,"description":"The operating system the kb article applies."},"product":{"$ref":"#/components/schemas/ocsfv1.3.0Product","nullable":true,"description":"The product details the kb article applies."},"severity":{"type":"string","nullable":true,"description":"The severity of the kb article."},"size":{"type":"integer","nullable":true,"description":"The size in bytes for the kb article."},"src_url":{"$ref":"#/components/schemas/ocsfv1.3.0URLString","nullable":true,"description":"The kb article link from the source vendor."},"title":{"type":"string","nullable":true,"description":"The title of the kb article."},"uid":{"type":"string","description":"The unique identifier for the kb article."}},"required":["uid"]}},"components/schemas/ocsfv1.3.0KbArticle_InstallStateId":{"id":"components/schemas/ocsfv1.3.0KbArticle_InstallStateId","kind":"json-schema","title":"ocsfv1.3.0KbArticle_InstallStateId","data":{"title":"ocsfv1.3.0KbArticle_InstallStateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"KbArticleInstallStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized install state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Installed: The item is installed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - NotInstalled: The item is not installed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - InstalledPendingReboot: The item is installed pending reboot operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The install state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"install_state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0KeyboardInfo":{"id":"components/schemas/ocsfv1.3.0KeyboardInfo","kind":"json-schema","title":"ocsfv1.3.0KeyboardInfo","data":{"title":"ocsfv1.3.0KeyboardInfo","type":"object","description":"The Keyboard Information object contains details and attributes related to a computer or device keyboard. It encompasses information that describes the characteristics, capabilities, and configuration of the keyboard.","properties":{"function_keys":{"type":"integer","nullable":true,"description":"The number of function keys on client keyboard."},"ime":{"type":"string","nullable":true,"description":"The Input Method Editor (IME) file name."},"keyboard_layout":{"type":"string","nullable":true,"description":"The keyboard locale identifier name (e.g., en-US)."},"keyboard_subtype":{"type":"integer","nullable":true,"description":"The keyboard numeric code."},"keyboard_type":{"type":"string","nullable":true,"description":"The keyboard type (e.g., xt, ico)."}}}},"components/schemas/ocsfv1.3.0KillChainPhase":{"id":"components/schemas/ocsfv1.3.0KillChainPhase","kind":"json-schema","title":"ocsfv1.3.0KillChainPhase","data":{"title":"ocsfv1.3.0KillChainPhase","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Kill Chain Phase object represents a single phase of a cyber attack, including the initial reconnaissance and planning stages up to the final objective of the attacker. It provides a detailed description of each phase and its associated activities within the broader context of a cyber attack. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Cyber Kill Chain®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"phase":{"type":"string","nullable":true,"description":"The cyber kill chain phase."},"phase_id":{"$ref":"#/components/schemas/ocsfv1.3.0KillChainPhase_PhaseId","description":"The cyber kill chain phase identifier."}},"required":["phase_id"]}},"components/schemas/ocsfv1.3.0KillChainPhase_PhaseId":{"id":"components/schemas/ocsfv1.3.0KillChainPhase_PhaseId","kind":"json-schema","title":"ocsfv1.3.0KillChainPhase_PhaseId","data":{"title":"ocsfv1.3.0KillChainPhase_PhaseId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"KillChainPhasePhaseId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The kill chain phase is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Reconnaissance: The attackers pick a target and perform a detailed analysis, start collecting information (email addresses, conferences information, etc.) and evaluate the victim’s vulnerabilities to determine how to exploit them."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Weaponization: The attackers develop a malware weapon and aim to exploit the discovered vulnerabilities."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Delivery: The intruders will use various tactics, such as phishing, infected USB drives, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Exploitation: The intruders start leveraging vulnerabilities to executed code on the victim’s system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Installation: The intruders install malware on the victim’s system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Control: Malware opens a command channel to enable the intruders to remotely manipulate the victim's system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - ActionsonObjectives: With hands-on keyboard access, intruders accomplish the mission’s goal."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The kill chain phase is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"phase"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0LdapPerson":{"id":"components/schemas/ocsfv1.3.0LdapPerson","kind":"json-schema","title":"ocsfv1.3.0LdapPerson","data":{"title":"ocsfv1.3.0LdapPerson","type":"object","description":"The additional LDAP attributes that describe a person.","properties":{"cost_center":{"type":"string","nullable":true,"description":"The cost center associated with the user."},"created_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The timestamp when the user was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user was created."},"deleted_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The timestamp when the user was deleted. In Active Directory (AD), when a user is deleted they are moved to a temporary container and then removed after 30 days. So, this field can be populated even after a user is deleted for the next 30 days."},"deleted_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user was deleted. In Active Directory (AD), when a user is deleted they are moved to a temporary container and then removed after 30 days. So, this field can be populated even after a user is deleted for the next 30 days."},"eligible_for_rehire":{"type":"boolean","nullable":true,"description":"Indicates whether the user is eligible for rehire. This typically applies to terminated or retired employees."},"email_addrs":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0EmailAddress"},"nullable":true,"description":"A list of additional email addresses for the user."},"employee_uid":{"type":"string","nullable":true,"description":"The employee identifier assigned to the user by the organization."},"employment_status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The employment status, normalized to the caption of the employment_status_id value. In the case of 'Other', it is defined by the data source."},"children":[],"type":"text"}],"type":"paragraph"}]},"employment_status_date":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The timestamp when the employment status was last changed."},"employment_status_date_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the employment status was last changed."},"employment_status_id":{"$ref":"#/components/schemas/ocsfv1.3.0LdapPerson_EmploymentStatusId","nullable":true,"description":"The normalized identifier of the user's employment status."},"given_name":{"type":"string","nullable":true,"description":"The given or first name of the user."},"hire_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The timestamp when the user was or will be hired by the organization."},"hire_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user was or will be hired by the organization."},"job_title":{"type":"string","nullable":true,"description":"The user's job title."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The labels associated with the user. For example in AD this could be the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"userType"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"employeeType"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Member, Employee"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"last_login_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The last time when the user logged in."},"last_login_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The last time when the user logged in."},"ldap_cn":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The LDAP and X.500 "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"commonName"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, typically the full name of the person. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"John Doe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"ldap_dn":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The X.500 Distinguished Name (DN) is a structured string that uniquely identifies an entry, such as a user, in an X.500 directory service For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cn=John Doe,ou=People,dc=example,dc=com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"leave_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The timestamp when the user left or will be leaving the organization."},"leave_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user left or will be leaving the organization."},"location":{"$ref":"#/components/schemas/ocsfv1.3.0Location","nullable":true,"description":"The geographical location associated with a user. This is typically the user's usual work location."},"manager":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The user's manager. This helps in understanding an org hierarchy. This should only ever be populated once in an event. I.e. there should not be a manager's manager in an event."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The timestamp when the user entry was last modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user entry was last modified."},"office_location":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The primary office location associated with the user. This could be any string and isn't a specific address. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"South East Virtual"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"position_start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The date the user first started work in their current position. For employees who have not changed positions, this equals the hire date. For employees who have transferred or been promoted, this reflects when they entered their current role."},"position_start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The date the user first started work in their current position. For employees who have not changed positions, this equals the hire date. For employees who have transferred or been promoted, this reflects when they entered their current role."},"regrettable_termination":{"type":"boolean","nullable":true,"description":"Indicates whether a termination is considered regrettable by the organization (i.e., loss of a valued employee). This is typically only populated for terminated employees."},"reports":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Object"},"nullable":true,"description":"The user's direct reports. This is the inverse of the manager relationship, representing users who report directly to this user in the organizational hierarchy. This field only includes immediate/direct reports, not transitive reports."},"surname":{"type":"string","nullable":true,"description":"The last or family name for the user."}}}},"components/schemas/ocsfv1.3.0LdapPerson_EmploymentStatusId":{"id":"components/schemas/ocsfv1.3.0LdapPerson_EmploymentStatusId","kind":"json-schema","title":"ocsfv1.3.0LdapPerson_EmploymentStatusId","data":{"title":"ocsfv1.3.0LdapPerson_EmploymentStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LdapPersonEmploymentStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The employment status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Applicant: The user is a job applicant or candidate who has not yet been hired."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Active: The user is currently employed and actively working."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Terminated: The user's employment has been terminated."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Retired: The user has retired from the organization."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The employment status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"employment_status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0LeaveEvent":{"id":"components/schemas/ocsfv1.3.0LeaveEvent","kind":"json-schema","title":"ocsfv1.3.0LeaveEvent","data":{"title":"ocsfv1.3.0LeaveEvent","type":"object","description":"A leave of absence event for a person. May represent a current, past, or future leave.","properties":{"desc":{"type":"string","nullable":true,"description":"The description that pertains to the object or event. See specific usage."},"leave_end_date":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The date on which the leave of absence ends."},"leave_end_date_dt":{"type":"string","format":"date-time","nullable":true,"description":"The date on which the leave of absence ends."},"leave_start_date":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The date on which the leave of absence begins."},"leave_start_date_dt":{"type":"string","format":"date-time","nullable":true,"description":"The date on which the leave of absence begins."}}}},"components/schemas/ocsfv1.3.0LoadBalancer":{"id":"components/schemas/ocsfv1.3.0LoadBalancer","kind":"json-schema","title":"ocsfv1.3.0LoadBalancer","data":{"title":"ocsfv1.3.0LoadBalancer","type":"object","description":"The load balancer object describes the load balancer entity and contains additional information regarding the distribution of traffic across a network.","properties":{"classification":{"type":"string","nullable":true,"description":"The request classification as defined by the load balancer."},"code":{"type":"integer","nullable":true,"description":"The numeric response status code detailing the connection from the load balancer to the destination target."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"The destination to which the load balancer is distributing traffic."},"endpoint_connections":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0EndpointConnection"},"nullable":true,"description":"An object detailing the load balancer connection attempts and responses."},"error_message":{"type":"string","nullable":true,"description":"The load balancer error message."},"ip":{"$ref":"#/components/schemas/ocsfv1.3.0IPAddress","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The IP address of the load balancer node that handled the client request. Note: the load balancer may have other IP addresses, and this is not an IP address of the target/distribution endpoint - see "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dst_endpoint"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The load balancer message."},"metrics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Metric"},"nullable":true,"description":"General purpose metrics associated with the load balancer."},"name":{"type":"string","nullable":true,"description":"The name of the load balancer."},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional status information about the load balancer distribution event."},"uid":{"type":"string","nullable":true,"description":"The unique identifier for the load balancer."}}}},"components/schemas/ocsfv1.3.0Location":{"id":"components/schemas/ocsfv1.3.0Location","kind":"json-schema","title":"ocsfv1.3.0Location","data":{"title":"ocsfv1.3.0Location","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Geo Location object describes a geographical location, usually associated with an IP address. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:PhysicalLocation"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"city":{"type":"string","nullable":true,"description":"The name of the city."},"continent":{"type":"string","nullable":true,"description":"The name of the continent."},"coordinates":{"type":"array","items":{"type":"number","format":"double"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A two-element array, containing a longitude/latitude pair. The format conforms with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://geojson.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"GeoJSON"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[-73.983, 40.719]"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"country":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The ISO 3166-1 Alpha-2 country code. For the complete list of country codes see "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.iso.org/obp/ui/#iso:pub:PUB500001:en"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ISO 3166-1 alpha-2 codes"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" The two letter country code should be capitalized. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"US"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CA"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"desc":{"type":"string","nullable":true,"description":"The description of the geographical location."},"geohash":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Geohash of the geo-coordinates (latitude and longitude)."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Geohash"}},"children":[{"$$mdtype":"Node","attributes":{"content":"Geohashing"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" is a geocoding system used to encode geographic coordinates in decimal degrees, to a single string."},"children":[],"type":"text"}]},"is_on_premises":{"type":"boolean","nullable":true,"description":"The indication of whether the location is on premises."},"isp":{"type":"string","nullable":true,"description":"The name of the Internet Service Provider (ISP)."},"lat":{"type":"number","format":"double","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The geographical Latitude coordinate represented in Decimal Degrees (DD). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"42.361145"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"long":{"type":"number","format":"double","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The geographical Longitude coordinate represented in Decimal Degrees (DD). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"-71.057083"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"postal_code":{"type":"string","nullable":true,"description":"The postal code of the location."},"provider":{"type":"string","nullable":true,"description":"The provider of the geographical location data."},"region":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. Region codes are defined at "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.iso.org/iso-3166-country-codes.html"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ISO 3166-2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and have a limit of three characters. For example, see "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.iso.org/obp/ui/#iso:code:3166:US"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"the region codes for the US"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"timezone":{"type":"string","nullable":true,"description":"Timezone string. This provides timezone information that may be present even when latitude and longitude are absent."}}}},"components/schemas/ocsfv1.3.0Logger":{"id":"components/schemas/ocsfv1.3.0Logger","kind":"json-schema","title":"ocsfv1.3.0Logger","data":{"title":"ocsfv1.3.0Logger","type":"object","description":"The Logger object represents the device and product where events are stored with times for receipt and transmission.  This may be at the source device where the event occurred, a remote scanning device, intermediate hops, or the ultimate destination.","properties":{"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"The device where the events are logged."},"log_level":{"type":"string","nullable":true,"description":"The audit level at which an event was generated."},"log_name":{"type":"string","nullable":true,"description":"The event log name. For example, syslog file name or Windows logging subsystem: Security."},"log_provider":{"type":"string","nullable":true,"description":"The logging provider or logging service that logged the event. For example, Microsoft-Windows-Security-Auditing."},"log_version":{"type":"string","nullable":true,"description":"The event log schema version that specifies the format of the original event. For example syslog version or Cisco Log Schema Version."},"logged_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The time when the logging system collected and logged the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different."},"children":[],"type":"text"}]},"logged_time_dt":{"type":"string","format":"date-time","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The time when the logging system collected and logged the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different."},"children":[],"type":"text"}]},"name":{"type":"string","nullable":true,"description":"The name of the logging product instance."},"product":{"$ref":"#/components/schemas/ocsfv1.3.0Product","nullable":true,"description":"The product logging the event.  This may be the event source product, a management server product, a scanning product, a SIEM, etc."},"transmit_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the event was transmitted from the logging device to it's next destination."},"transmit_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the event was transmitted from the logging device to it's next destination."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the logging product instance."},"version":{"type":"string","nullable":true,"description":"The version of the logging product."}}}},"components/schemas/ocsfv1.3.0Malware":{"id":"components/schemas/ocsfv1.3.0Malware","kind":"json-schema","title":"ocsfv1.3.0Malware","data":{"title":"ocsfv1.3.0Malware","type":"object","description":"The Malware object describes the classification of known malicious software, which is intentionally designed to cause damage to a computer, server, client, or computer network.","properties":{"classification_ids":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Malware_ClassificationIds"},"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of normalized identifiers of the malware classifications. Reference: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_oxlc4df65spl"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"STIX Malware Types"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"classifications":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of malware classifications, normalized to the captions of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"classification_ids"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" values. In the case of 'Other', they are defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"cves":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Cve"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"List of Common Vulnerabilities and Exposures ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cve.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVE"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","nullable":true,"description":"The malware name, as reported by the detection engine."},"path":{"type":"string","nullable":true,"description":"The filesystem path of the malware that was observed."},"provider":{"type":"string","nullable":true,"description":"The provider of the malware information."},"uid":{"type":"string","nullable":true,"description":"The malware unique identifier, as reported by the detection engine. For example a virus id or an IPS signature id."}},"required":["classification_ids"]}},"components/schemas/ocsfv1.3.0Malware_ClassificationIds":{"id":"components/schemas/ocsfv1.3.0Malware_ClassificationIds","kind":"json-schema","title":"ocsfv1.3.0Malware_ClassificationIds","data":{"title":"ocsfv1.3.0Malware_ClassificationIds","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MalwareClassificationIds is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The classification is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Adware"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Backdoor"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Bot"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Bootkit"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - DDOS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Downloader"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Dropper"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Kit"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Keylogger"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Ransomware"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Access_Trojan"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Exploitation"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Security_Software"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Rootkit"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - Capture"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Spyware"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Trojan"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Virus"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Webshell"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Wiper"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Worm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The classification is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"classifications"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0ManagedEntity":{"id":"components/schemas/ocsfv1.3.0ManagedEntity","kind":"json-schema","title":"ocsfv1.3.0ManagedEntity","data":{"title":"ocsfv1.3.0ManagedEntity","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Managed Entity object describes the type and version of an entity, such as a user, device, or policy.  For types in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" enum list, an associated attribute should be populated.  If the type of entity is not in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" list, information can be put into the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"data"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute and the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should identify the entity."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"data":{"nullable":true,"description":"The managed entity content as a JSON object."},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"An addressable device, computer system or host."},"email":{"$ref":"#/components/schemas/ocsfv1.3.0Email","nullable":true,"description":"The email object."},"group":{"$ref":"#/components/schemas/ocsfv1.3.0Group","nullable":true,"description":"The group object associated with an entity such as user, policy, or rule."},"name":{"type":"string","nullable":true,"description":"The name of the managed entity."},"org":{"$ref":"#/components/schemas/ocsfv1.3.0Organization","nullable":true,"description":"Organization and org unit relevant to the event or object."},"policy":{"$ref":"#/components/schemas/ocsfv1.3.0Policy","nullable":true,"description":"Describes details of a managed policy."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The managed entity type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"policy"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"user"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"organizational unit"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"device"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0ManagedEntity_TypeId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of the Managed Entity. It is recommended to also populate the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute with the associated label, or the source specific name if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"The identifier of the managed entity."},"user":{"$ref":"#/components/schemas/ocsfv1.3.0User","nullable":true,"description":"The user that pertains to the event or object."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The version of the managed entity. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.2.3"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.3.0ManagedEntity_TypeId":{"id":"components/schemas/ocsfv1.3.0ManagedEntity_TypeId","kind":"json-schema","title":"ocsfv1.3.0ManagedEntity_TypeId","data":{"title":"ocsfv1.3.0ManagedEntity_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ManagedEntityTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Device: A managed Device entity.  This item corresponds to population of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"device"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - User: A managed User entity.  This item corresponds to population of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"user"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Group: A managed Group entity.  This item corresponds to population of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"group"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Organization: A managed Organization entity.  This item corresponds to population of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"org"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Policy: A managed Policy entity.  This item corresponds to population of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"policy"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Email: A managed Email entity.  This item corresponds to population of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"email"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Meeting":{"id":"components/schemas/ocsfv1.3.0Meeting","kind":"json-schema","title":"ocsfv1.3.0Meeting","data":{"title":"ocsfv1.3.0Meeting","type":"object","description":"The Meeting object encompasses information relating to a meeting, such as might be present in typical office calendar software like Teams, Outlook, Google Calendar, etc.","properties":{"attendees":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0MeetingAttendee"},"nullable":true,"description":"Actors who are attendees of the meeting."},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"Time at which the meeting is scheduled to end."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"Time at which the meeting is scheduled to end."},"name":{"type":"string","nullable":true,"description":"The meeting's display name."},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"Time at which the meeting is scheduled to begin."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"Time at which the meeting is scheduled to begin."},"uid":{"type":"string","nullable":true,"description":"Unique ID associated with the meeting."},"urls":{"type":"array","items":{"type":"string"},"nullable":true,"description":"URLs associated with the meeting, e.g. video conference links."}}}},"components/schemas/ocsfv1.3.0MeetingAttendee":{"id":"components/schemas/ocsfv1.3.0MeetingAttendee","kind":"json-schema","title":"ocsfv1.3.0MeetingAttendee","data":{"title":"ocsfv1.3.0MeetingAttendee","type":"object","description":"The Meeting Attendee object encompasses information related to a meeting attendee.","properties":{"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor corresponding to the entity joining the meeting."},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"Information about the attendee's device."},"invited_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"When the actor was invited to the meeting."},"invited_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"When the actor was invited to the meeting."},"inviter":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor who invited the attendee to the meeting."},"join_times":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp"},"nullable":true,"description":"Time(s) at which the attendee joined the meeting."},"join_times_dt":{"type":"array","items":{"type":"string","format":"date-time"},"nullable":true,"description":"Time(s) at which the attendee joined the meeting."},"leave_times":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp"},"nullable":true,"description":"Time(s) at which the attendee left the meeting."},"leave_times_dt":{"type":"array","items":{"type":"string","format":"date-time"},"nullable":true,"description":"Time(s) at which the attendee left the meeting."}}}},"components/schemas/ocsfv1.3.0Messaging":{"id":"components/schemas/ocsfv1.3.0Messaging","kind":"json-schema","title":"ocsfv1.3.0Messaging","data":{"title":"ocsfv1.3.0Messaging","type":"object","description":"The Messaging object encompasses information related to instant messaging, such as sending messages, adding a user to a channel, etc.","properties":{"channel_name":{"type":"string","nullable":true,"description":"Name of the channel that the event pertains to."},"channel_uid":{"type":"string","nullable":true,"description":"ID of the channel that the event pertains to."},"domains":{"type":"array","items":{"type":"string"},"nullable":true,"description":"List of domains participating in the chat session."},"has_foreign_tenant_users":{"type":"boolean","nullable":true,"description":"True if the event pertains to a channel or group which contains users from a foreign tenant."},"has_guest_users":{"type":"boolean","nullable":true,"description":"True if the event pertains to a channel or group which contains guest users."},"has_unauthenticated_users":{"type":"boolean","nullable":true,"description":"True if the event pertains to a channel or group which contains users that are not authenticated."},"members":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Actor"},"nullable":true,"description":"Actors to whom the event pertains."},"message_urls":{"type":"array","items":{"type":"string"},"nullable":true,"description":"URLs contained in the messages which are relevant to the chat session or event."},"session_name":{"type":"string","nullable":true,"description":"Name of the session that the event pertains to, e.g. a chat specific to a meeting, or a thread within a channel."},"session_uid":{"type":"string","nullable":true,"description":"ID of the session."},"uid":{"type":"string","nullable":true,"description":"UID of the event, e.g. unique message ID."}}}},"components/schemas/ocsfv1.3.0Metadata":{"id":"components/schemas/ocsfv1.3.0Metadata","kind":"json-schema","title":"ocsfv1.3.0Metadata","data":{"title":"ocsfv1.3.0Metadata","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Metadata object describes the metadata associated with the event. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Metadata/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:Metadata"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"correlation_uid":{"type":"string","nullable":true,"description":"The unique identifier used to correlate events."},"event_code":{"type":"string","nullable":true,"description":"The Event ID or Code that the product uses to describe the event."},"extension":{"$ref":"#/components/schemas/ocsfv1.3.0Extension","nullable":true,"description":"The schema extension used to create the event."},"extensions":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Extension"},"nullable":true,"description":"The schema extensions used to create the event."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The list of category labels attached to the event or specific attributes. Labels are user defined tags or aliases added at normalization time."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"[\"network\", \"connection.ip:destination\", \"device.ip:source\"]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}]},"log_level":{"type":"string","nullable":true,"description":"The audit level at which an event was generated."},"log_name":{"type":"string","nullable":true,"description":"The event log name. For example, syslog file name or Windows logging subsystem: Security."},"log_provider":{"type":"string","nullable":true,"description":"The logging provider or logging service that logged the event. For example, Microsoft-Windows-Security-Auditing."},"log_version":{"type":"string","nullable":true,"description":"The event log schema version that specifies the format of the original event. For example syslog version or Cisco Log Schema Version."},"logged_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The time when the logging system collected and logged the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different."},"children":[],"type":"text"}]},"logged_time_dt":{"type":"string","format":"date-time","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The time when the logging system collected and logged the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different."},"children":[],"type":"text"}]},"loggers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Logger"},"nullable":true,"description":"An array of Logger objects that describe the devices and logging products between the event source and its eventual destination. Note, this attribute can be used when there is a complex end-to-end path of event flow."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the event was last modified or enriched."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the event was last modified or enriched."},"original_time":{"type":"string","nullable":true,"description":"The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs."},"processed_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The event processed time, such as an ETL operation."},"processed_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The event processed time, such as an ETL operation."},"product":{"$ref":"#/components/schemas/ocsfv1.3.0Product","description":"The product that reported the event."},"profiles":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of profiles used to create the event.  Profiles should be referenced by their "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for core profiles, or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"extension/name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for profiles from extensions."},"children":[],"type":"text"}],"type":"paragraph"}]},"sequence":{"type":"integer","nullable":true,"description":"Sequence number of the event. The sequence number is a value available in some events, to make the exact ordering of events unambiguous, regardless of the event time precision."},"tenant_uid":{"type":"string","nullable":true,"description":"The unique tenant identifier."},"uid":{"type":"string","nullable":true,"description":"The logging system-assigned unique identifier of an event instance."},"version":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The version of the OCSF schema, using Semantic Versioning Specification ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://semver.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SemVer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"). For example: 1.0.0. Event consumers use the version to determine the available event attributes."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["product","version"]}},"components/schemas/ocsfv1.3.0Metric":{"id":"components/schemas/ocsfv1.3.0Metric","kind":"json-schema","title":"ocsfv1.3.0Metric","data":{"title":"ocsfv1.3.0Metric","type":"object","description":"The Metric object defines a simple name/value pair entity for a metric.","properties":{"name":{"type":"string","description":"The name of the metric."},"value":{"type":"string","description":"The value of the metric."}},"required":["name","value"]}},"components/schemas/ocsfv1.3.0Module":{"id":"components/schemas/ocsfv1.3.0Module","kind":"json-schema","title":"ocsfv1.3.0Module","data":{"title":"ocsfv1.3.0Module","type":"object","description":"The Module object describes the load attributes of a module.","properties":{"base_address":{"type":"string","nullable":true,"description":"The memory address where the module was loaded."},"file":{"$ref":"#/components/schemas/ocsfv1.3.0File","nullable":true,"description":"The module file object."},"function_name":{"type":"string","nullable":true,"description":"The entry-point function of the module. The system calls the entry-point function whenever a process or thread loads or unloads the module."},"load_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The load type, normalized to the caption of the load_type_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"load_type_id":{"$ref":"#/components/schemas/ocsfv1.3.0Module_LoadTypeId","description":"The normalized identifier for how the module was loaded in memory."},"start_address":{"type":"string","nullable":true,"description":"The start address of the execution."},"type":{"type":"string","nullable":true,"description":"The module type."}},"required":["load_type_id"]}},"components/schemas/ocsfv1.3.0Module_LoadTypeId":{"id":"components/schemas/ocsfv1.3.0Module_LoadTypeId","kind":"json-schema","title":"ocsfv1.3.0Module_LoadTypeId","data":{"title":"ocsfv1.3.0Module_LoadTypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ModuleLoadTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The load type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Standard: A normal module loaded by the normal windows loading mechanism i.e. LoadLibrary."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - NonStandard: A module loaded in a way avoidant of normal windows procedures. i.e. Bootstrapped Loading/Manual Dll Loading."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - ShellCode: A raw module in process memory that is READWRITE_EXECUTE and had a thread started in its range."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Mapped: A memory mapped file, typically created with CreatefileMapping/MapViewOfFile."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - NonStandardBacked: A module loaded in a non standard way. However, GetModuleFileName succeeds on this allocation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The load type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"load_type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0NetworkConnectionInfo":{"id":"components/schemas/ocsfv1.3.0NetworkConnectionInfo","kind":"json-schema","title":"ocsfv1.3.0NetworkConnectionInfo","data":{"title":"ocsfv1.3.0NetworkConnectionInfo","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Network Connection Information object describes characteristics of a network connection. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:NetworkSession/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:NetworkSession"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"boundary":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The boundary of the connection, normalized to the caption of 'boundary_id'. In the case of 'Other', it is defined by the event source. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" For cloud connections, this translates to the traffic-boundary(same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"boundary_id":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkConnectionInfo_BoundaryId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the boundary of the connection. "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":" For cloud connections, this translates to the traffic-boundary (same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External."},"children":[],"type":"text"}],"type":"tag","tag":"html"}]},"direction":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The direction of the initiated connection, traffic, or email, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"direction_id":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkConnectionInfo_DirectionId","description":"The normalized identifier of the direction of the initiated connection, traffic, or email."},"protocol_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The TCP/IP protocol name in lowercase, as defined by the Internet Assigned Numbers Authority (IANA). See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Protocol Numbers"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tcp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"udp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"protocol_num":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The TCP/IP protocol number, as defined by the Internet Assigned Numbers Authority (IANA). Use -1 if the protocol is not defined by IANA. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Protocol Numbers"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"6"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for TCP and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"17"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for UDP."},"children":[],"type":"text"}],"type":"paragraph"}]},"protocol_ver":{"type":"string","nullable":true,"description":"The Internet Protocol version."},"protocol_ver_id":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkConnectionInfo_ProtocolVerId","nullable":true,"description":"The Internet Protocol version identifier."},"session":{"$ref":"#/components/schemas/ocsfv1.3.0Session","nullable":true,"description":"The authenticated user or service session."},"tcp_flags":{"type":"integer","nullable":true,"description":"The network connection TCP header flags (i.e., control bits)."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the connection."}},"required":["direction_id"]}},"components/schemas/ocsfv1.3.0NetworkConnectionInfo_BoundaryId":{"id":"components/schemas/ocsfv1.3.0NetworkConnectionInfo_BoundaryId","kind":"json-schema","title":"ocsfv1.3.0NetworkConnectionInfo_BoundaryId","data":{"title":"ocsfv1.3.0NetworkConnectionInfo_BoundaryId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkConnectionInfoBoundaryId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The connection boundary is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Localhost: Local network traffic on the same endpoint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Internal: Internal network traffic between two endpoints inside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - External: External network traffic between two endpoints on the Internet or outside the network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - SameVPC: Through another resource in the same VPC"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - VPCGateway: Through an Internet gateway or a gateway VPC endpoint"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - VirtualPrivateGateway: Through a virtual private gateway"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - regionVPC: Through an intra-region VPC peering connection"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - regionVPC: Through an inter-region VPC peering connection"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - LocalGateway: Through a local gateway"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - GatewayVPC: Through a gateway VPC endpoint (Nitro-based instances only)"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - InternetGateway: Through an Internet gateway (Nitro-based instances only)"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The boundary is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"boundary"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0NetworkConnectionInfo_DirectionId":{"id":"components/schemas/ocsfv1.3.0NetworkConnectionInfo_DirectionId","kind":"json-schema","title":"ocsfv1.3.0NetworkConnectionInfo_DirectionId","data":{"title":"ocsfv1.3.0NetworkConnectionInfo_DirectionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkConnectionInfoDirectionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The connection direction is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Inbound: Inbound network connection. The connection was originated from the Internet or outside network, destined for services on the inside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Outbound: Outbound network connection. The connection was originated from inside the network, destined for services on the Internet or outside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Lateral: Lateral network connection. The connection was originated from inside the network, destined for services on the inside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The direction is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"direction"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0NetworkConnectionInfo_ProtocolVerId":{"id":"components/schemas/ocsfv1.3.0NetworkConnectionInfo_ProtocolVerId","kind":"json-schema","title":"ocsfv1.3.0NetworkConnectionInfo_ProtocolVerId","data":{"title":"ocsfv1.3.0NetworkConnectionInfo_ProtocolVerId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkConnectionInfoProtocolVerId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The protocol version is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - IPv4_"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - IPv6_"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The protocol version is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"protocol_ver"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0NetworkEndpoint":{"id":"components/schemas/ocsfv1.3.0NetworkEndpoint","kind":"json-schema","title":"ocsfv1.3.0NetworkEndpoint","data":{"title":"ocsfv1.3.0NetworkEndpoint","type":"object","description":"The Network Endpoint object describes characteristics of a network endpoint. These can be a source or destination of a network connection.","properties":{"agent_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Agent"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"agent"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects associated with a device, endpoint, or resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"autonomous_system":{"$ref":"#/components/schemas/ocsfv1.3.0AutonomousSystem","nullable":true,"description":"The Autonomous System details associated with an IP address."},"container":{"$ref":"#/components/schemas/ocsfv1.3.0Container","nullable":true,"description":"The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd."},"domain":{"type":"string","nullable":true,"description":"The name of the domain."},"hostname":{"$ref":"#/components/schemas/ocsfv1.3.0Hostname","nullable":true,"description":"The fully qualified name of the endpoint."},"hw_info":{"$ref":"#/components/schemas/ocsfv1.3.0DeviceHwInfo","nullable":true,"description":"The endpoint hardware information."},"instance_uid":{"type":"string","nullable":true,"description":"The unique identifier of a VM instance."},"interface_name":{"type":"string","nullable":true,"description":"The name of the network interface (e.g. eth2)."},"interface_uid":{"type":"string","nullable":true,"description":"The unique identifier of the network interface."},"intermediate_ips":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0IPAddress"},"nullable":true,"description":"The intermediate IP Addresses. For example, the IP addresses in the HTTP X-Forwarded-For header."},"ip":{"$ref":"#/components/schemas/ocsfv1.3.0IPAddress","nullable":true,"description":"The IP address of the endpoint, in either IPv4 or IPv6 format."},"location":{"$ref":"#/components/schemas/ocsfv1.3.0Location","nullable":true,"description":"The geographical location of the endpoint."},"mac":{"$ref":"#/components/schemas/ocsfv1.3.0MACAddress","nullable":true,"description":"The Media Access Control (MAC) address of the endpoint."},"name":{"type":"string","nullable":true,"description":"The short name of the endpoint."},"namespace_pid":{"type":"integer","nullable":true,"description":"If running under a process namespace (such as in a container), the process identifier within that process namespace."},"os":{"$ref":"#/components/schemas/ocsfv1.3.0Os","nullable":true,"description":"The endpoint operating system."},"owner":{"$ref":"#/components/schemas/ocsfv1.3.0User","nullable":true,"description":"The identity of the service or user account that owns the endpoint or was last logged into it."},"port":{"$ref":"#/components/schemas/ocsfv1.3.0Port","nullable":true,"description":"The port used for communication within the network connection."},"proxy_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkProxy","nullable":true,"description":"The network proxy information pertaining to a specific endpoint. This can be used to describe information pertaining to network address translation (NAT)."},"subnet_uid":{"type":"string","nullable":true,"description":"The unique identifier of a virtual subnet."},"svc_name":{"type":"string","nullable":true,"description":"The service name in service-to-service connections. For example, AWS VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields identify the connection is coming from or going to an AWS service."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network endpoint type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"unknown"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint_TypeId","nullable":true,"description":"The network endpoint type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the endpoint."},"vlan_uid":{"type":"string","nullable":true,"description":"The Virtual LAN identifier."},"vpc_uid":{"type":"string","nullable":true,"description":"The unique identifier of the Virtual Private Cloud (VPC)."},"zone":{"type":"string","nullable":true,"description":"The network zone or LAN segment."}}}},"components/schemas/ocsfv1.3.0NetworkEndpoint_TypeId":{"id":"components/schemas/ocsfv1.3.0NetworkEndpoint_TypeId","kind":"json-schema","title":"ocsfv1.3.0NetworkEndpoint_TypeId","data":{"title":"ocsfv1.3.0NetworkEndpoint_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkEndpointTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Server: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Server/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Desktop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Laptop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Tablet: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Mobile: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile phone"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Virtual: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual machine"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - IOT: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.techtarget.com/iotagenda/definition/IoT-device"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IOT (Internet of Things) device"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Browser: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Browser/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"web browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Firewall: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Firewall/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking firewall"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Switch: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Switch/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking switch"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Hub: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Ethernet_hub"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking hub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - Router: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Router/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking router"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - IDS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion detection system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - IPS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion prevention system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - LoadBalancer: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Load_balancing_(computing)"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Load Balancer device."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0NetworkInterface":{"id":"components/schemas/ocsfv1.3.0NetworkInterface","kind":"json-schema","title":"ocsfv1.3.0NetworkInterface","data":{"title":"ocsfv1.3.0NetworkInterface","type":"object","description":"The Network Interface object describes the type and associated attributes of a network interface.","properties":{"hostname":{"$ref":"#/components/schemas/ocsfv1.3.0Hostname","nullable":true,"description":"The hostname associated with the network interface."},"ip":{"$ref":"#/components/schemas/ocsfv1.3.0IPAddress","nullable":true,"description":"The IP address associated with the network interface."},"ip_addresses":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of IP addresses available on the network interface."},"mac":{"$ref":"#/components/schemas/ocsfv1.3.0MACAddress","nullable":true,"description":"The MAC address of the network interface."},"mac_addresses":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of MAC addresses available on the network interface."},"name":{"type":"string","nullable":true,"description":"The name of the network interface."},"namespace":{"type":"string","nullable":true,"description":"The namespace is useful in merger or acquisition situations. For example, when similar entities exist that you need to keep separate."},"subnet_prefix":{"type":"integer","nullable":true,"description":"The subnet prefix length determines the number of bits used to represent the network part of the IP address. The remaining bits are reserved for identifying individual hosts within that subnet."},"type":{"type":"string","nullable":true,"description":"The type of network interface."},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkInterface_TypeId","description":"The network interface type identifier."},"uid":{"type":"string","nullable":true,"description":"The unique identifier for the network interface."}},"required":["type_id"]}},"components/schemas/ocsfv1.3.0NetworkInterface_TypeId":{"id":"components/schemas/ocsfv1.3.0NetworkInterface_TypeId","kind":"json-schema","title":"ocsfv1.3.0NetworkInterface_TypeId","data":{"title":"ocsfv1.3.0NetworkInterface_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkInterfaceTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Wired"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Wireless"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Mobile"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Tunnel"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0NetworkProxy":{"id":"components/schemas/ocsfv1.3.0NetworkProxy","kind":"json-schema","title":"ocsfv1.3.0NetworkProxy","data":{"title":"ocsfv1.3.0NetworkProxy","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network proxy endpoint object describes a proxy server, which acts as an intermediary between a client requesting a resource and the server providing that resource.  Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:ProxyServer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:ProxyServer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"agent_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Agent"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"agent"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects associated with a device, endpoint, or resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"autonomous_system":{"$ref":"#/components/schemas/ocsfv1.3.0AutonomousSystem","nullable":true,"description":"The Autonomous System details associated with an IP address."},"container":{"$ref":"#/components/schemas/ocsfv1.3.0Container","nullable":true,"description":"The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd."},"domain":{"type":"string","nullable":true,"description":"The name of the domain."},"hostname":{"$ref":"#/components/schemas/ocsfv1.3.0Hostname","nullable":true,"description":"The fully qualified name of the endpoint."},"hw_info":{"$ref":"#/components/schemas/ocsfv1.3.0DeviceHwInfo","nullable":true,"description":"The endpoint hardware information."},"instance_uid":{"type":"string","nullable":true,"description":"The unique identifier of a VM instance."},"interface_name":{"type":"string","nullable":true,"description":"The name of the network interface (e.g. eth2)."},"interface_uid":{"type":"string","nullable":true,"description":"The unique identifier of the network interface."},"intermediate_ips":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0IPAddress"},"nullable":true,"description":"The intermediate IP Addresses. For example, the IP addresses in the HTTP X-Forwarded-For header."},"ip":{"$ref":"#/components/schemas/ocsfv1.3.0IPAddress","nullable":true,"description":"The IP address of the endpoint, in either IPv4 or IPv6 format."},"location":{"$ref":"#/components/schemas/ocsfv1.3.0Location","nullable":true,"description":"The geographical location of the endpoint."},"mac":{"$ref":"#/components/schemas/ocsfv1.3.0MACAddress","nullable":true,"description":"The Media Access Control (MAC) address of the endpoint."},"name":{"type":"string","nullable":true,"description":"The short name of the endpoint."},"namespace_pid":{"type":"integer","nullable":true,"description":"If running under a process namespace (such as in a container), the process identifier within that process namespace."},"os":{"$ref":"#/components/schemas/ocsfv1.3.0Os","nullable":true,"description":"The endpoint operating system."},"owner":{"$ref":"#/components/schemas/ocsfv1.3.0User","nullable":true,"description":"The identity of the service or user account that owns the endpoint or was last logged into it."},"port":{"$ref":"#/components/schemas/ocsfv1.3.0Port","nullable":true,"description":"The port used for communication within the network connection."},"proxy_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The network proxy information pertaining to a specific endpoint. This can be used to describe information pertaining to network address translation (NAT)."},"subnet_uid":{"type":"string","nullable":true,"description":"The unique identifier of a virtual subnet."},"svc_name":{"type":"string","nullable":true,"description":"The service name in service-to-service connections. For example, AWS VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields identify the connection is coming from or going to an AWS service."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network endpoint type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"unknown"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkProxy_TypeId","nullable":true,"description":"The network endpoint type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the endpoint."},"vlan_uid":{"type":"string","nullable":true,"description":"The Virtual LAN identifier."},"vpc_uid":{"type":"string","nullable":true,"description":"The unique identifier of the Virtual Private Cloud (VPC)."},"zone":{"type":"string","nullable":true,"description":"The network zone or LAN segment."}}}},"components/schemas/ocsfv1.3.0NetworkProxy_TypeId":{"id":"components/schemas/ocsfv1.3.0NetworkProxy_TypeId","kind":"json-schema","title":"ocsfv1.3.0NetworkProxy_TypeId","data":{"title":"ocsfv1.3.0NetworkProxy_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkProxyTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Server: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Server/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Desktop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Laptop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Tablet: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Mobile: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile phone"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Virtual: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual machine"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - IOT: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.techtarget.com/iotagenda/definition/IoT-device"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IOT (Internet of Things) device"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Browser: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Browser/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"web browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Firewall: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Firewall/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking firewall"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Switch: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Switch/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking switch"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Hub: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Ethernet_hub"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking hub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - Router: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Router/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking router"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - IDS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion detection system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - IPS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion prevention system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - LoadBalancer: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Load_balancing_(computing)"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Load Balancer device."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0NetworkTraffic":{"id":"components/schemas/ocsfv1.3.0NetworkTraffic","kind":"json-schema","title":"ocsfv1.3.0NetworkTraffic","data":{"title":"ocsfv1.3.0NetworkTraffic","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Network Traffic object describes characteristics of network traffic. Network traffic refers to data moving across a network at a given point of time. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:NetworkTraffic/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:NetworkTraffic"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"bytes":{"type":"integer","nullable":true,"description":"The total number of bytes (in and out)."},"bytes_in":{"type":"integer","nullable":true,"description":"The number of bytes sent from the destination to the source."},"bytes_out":{"type":"integer","nullable":true,"description":"The number of bytes sent from the source to the destination."},"chunks":{"type":"integer","nullable":true,"description":"The total number of chunks (in and out)."},"chunks_in":{"type":"integer","nullable":true,"description":"The number of chunks sent from the destination to the source."},"chunks_out":{"type":"integer","nullable":true,"description":"The number of chunks sent from the source to the destination."},"packets":{"type":"integer","nullable":true,"description":"The total number of packets (in and out)."},"packets_in":{"type":"integer","nullable":true,"description":"The number of packets sent from the destination to the source."},"packets_out":{"type":"integer","nullable":true,"description":"The number of packets sent from the source to the destination."}}}},"components/schemas/ocsfv1.3.0Object":{"id":"components/schemas/ocsfv1.3.0Object","kind":"json-schema","title":"ocsfv1.3.0Object","data":{"title":"ocsfv1.3.0Object","type":"object","additionalProperties":true,"description":"An unordered collection of attributes. It defines a set of attributes available in all objects. It can be also used as a generic object to log objects that are not otherwise defined by the schema."}},"components/schemas/ocsfv1.3.0Observable":{"id":"components/schemas/ocsfv1.3.0Observable","kind":"json-schema","title":"ocsfv1.3.0Observable","data":{"title":"ocsfv1.3.0Observable","type":"object","description":"The observable object is a pivot element that contains related information found in many places in the event.","properties":{"name":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full name of the observable attribute. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is a pointer/reference to an attribute within the event data. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"file.name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"reputation":{"$ref":"#/components/schemas/ocsfv1.3.0Reputation","nullable":true,"description":"Contains the original and normalized reputation scores."},"type":{"type":"string","nullable":true,"description":"The observable value type name."},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0Observable_TypeId","description":"The observable value type identifier."},"value":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The value associated with the observable attribute. The meaning of the value depends on the observable type."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" refers to a scalar attribute, then the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is the value of the attribute."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" refers to an object attribute, then the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is not populated."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["name","type_id"]}},"components/schemas/ocsfv1.3.0Observable_TypeId":{"id":"components/schemas/ocsfv1.3.0Observable_TypeId","kind":"json-schema","title":"ocsfv1.3.0Observable_TypeId","data":{"title":"ocsfv1.3.0Observable_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ObservableTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: Unknown observable data type."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Hostname: Unique name assigned to a device connected to a computer network. A domain name in general is an Internet address that can be resolved through the Domain Name System (DNS). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"r2-d2.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or IPv6 format. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"192.168.200.24"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2001:0db8:85a3:0000:0000:8a2e:0370:7334"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - MACAddress: Media Access Control (MAC) address. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"18:36:F3:98:4F:9A"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - UserName: User name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"john_doe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - EmailAddress: Email address. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"john_doe@example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - URLString: Uniform Resource Locator (URL) string. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http://www.example.com/download/trouble.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - FileName: File name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"text-file.txt"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Hash: Hash. A unique value that corresponds to the content of the file, image, ja3_hash or hassh found in the schema. For example MD5: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3172ac7e2b55cbb81f04a6e65855a628"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - ProcessName: Process name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notepad"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - ResourceUID: Resource unique identifier. For example, S3 Bucket name or EC2 Instance ID."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Port: The TCP/UDP port number. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"80"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"22"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - Subnet: The subnet represented in a CIDR notation, using the format network_address/prefix_length. The network_address can be in either IPv4 or IPv6 format. The prefix length indicates the number of bits used for the network portion, and the remaining bits are available for host addresses within that subnet. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"div","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"192.168.1.0/24"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2001:0db8:85a3:0000::/64"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Endpoint: The Endpoint object describes a physical or virtual device that connects to and exchanges information with a computer network. Some examples of endpoints are mobile devices, desktop computers, virtual machines, embedded devices, and servers. Internet-of-Things devices—like cameras, lighting, refrigerators, security systems, smart speakers, and thermostats—are also endpoints."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - User: The User object describes the characteristics of a user/person or a security principal. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:UserAccount"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Email: The Email object describes the email metadata such as sender, recipients, and direction. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Email/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:Email"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - UniformResourceLocator: The Uniform Resource Locator(URL) object describes the characteristics of a URL. Defined in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc1738"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC 1738"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:URL/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:URL"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - File: The File object represents the metadata associated with a file stored in a computer system. It encompasses information about the file itself, including its attributes, properties, and organizational details. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://next.d3fend.mitre.org/dao/artifact/d3f:File/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:File"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Process: The Process object describes a running instance of a launched program. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Process/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:Process"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - GeoLocation: The Geo Location object describes a geographical location, usually associated with an IP address. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:PhysicalLocation"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Container: The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"30 - Fingerprint: The Fingerprint object provides detailed information about a digital fingerprint, which is a compact representation of data used to identify a longer piece of information, such as a public key or file content. It contains the algorithm and value of the fingerprint, enabling efficient and reliable identification of the associated data."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The observable data type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which may contain data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Organization":{"id":"components/schemas/ocsfv1.3.0Organization","kind":"json-schema","title":"ocsfv1.3.0Organization","data":{"title":"ocsfv1.3.0Organization","type":"object","description":"The Organization object describes characteristics of an organization or company and its division if any.","properties":{"name":{"type":"string","nullable":true,"description":"The name of the organization. For example, Widget, Inc."},"ou_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the organizational unit, within an organization.  For example, Finance, IT, R&D"},"children":[],"type":"text"}],"type":"paragraph"}]},"ou_uid":{"type":"string","nullable":true,"description":"The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the organization. For example, its Active Directory or AWS Org ID."}}}},"components/schemas/ocsfv1.3.0Os":{"id":"components/schemas/ocsfv1.3.0Os","kind":"json-schema","title":"ocsfv1.3.0Os","data":{"title":"ocsfv1.3.0Os","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Operating System (OS) object describes characteristics of an OS, such as Linux or Windows. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:OperatingSystem"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"build":{"type":"string","nullable":true,"description":"The operating system build number."},"country":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The operating system country code, as defined by the ISO 3166-1 standard (Alpha-2 code). For the complete list of country codes, see "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.iso.org/obp/ui/#iso:pub:PUB500001:en"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ISO 3166-1 alpha-2 codes"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpe_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Platform Enumeration (CPE) name as described by ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://nvd.nist.gov/products/cpe"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpe:/a:apple:safari:16.2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_bits":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cpu architecture, the number of bits used for addressing in memory. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"32"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"64"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"edition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The operating system edition. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Professional"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"lang":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The two letter lower case language codes, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/ISO_639-1"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ISO 639-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"en"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (English), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"de"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (German), or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"fr"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (French)."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","description":"The operating system name."},"sp_name":{"type":"string","nullable":true,"description":"The name of the latest Service Pack."},"sp_ver":{"type":"integer","nullable":true,"description":"The version number of the latest Service Pack."},"type":{"type":"string","nullable":true,"description":"The type of the operating system."},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0Os_TypeId","description":"The type identifier of the operating system."},"version":{"type":"string","nullable":true,"description":"The version of the OS running on the device that originated the event. For example: \"Windows 10\", \"OS X 10.7\", or \"iOS 9\"."}},"required":["name","type_id"]}},"components/schemas/ocsfv1.3.0Os_TypeId":{"id":"components/schemas/ocsfv1.3.0Os_TypeId","kind":"json-schema","title":"ocsfv1.3.0Os_TypeId","data":{"title":"ocsfv1.3.0Os_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OsTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"100 - Windows"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"101 - WindowsMobile"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"200 - Linux"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"201 - Android"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"300 - macOS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"301 - iOS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"302 - iPadOS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400 - Solaris"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"401 - AIX"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"402 - UX"},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Osint":{"id":"components/schemas/ocsfv1.3.0Osint","kind":"json-schema","title":"ocsfv1.3.0Osint","data":{"title":"ocsfv1.3.0Osint","type":"object","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","properties":{"answers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0DnsAnswer"},"nullable":true,"description":"Any pertinent DNS answers information related to an indicator or OSINT analysis."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK Tactics, Techniques, and/or Procedures (TTPs) pertinent to an indicator or OSINT analysis."},"children":[],"type":"text"}],"type":"paragraph"}]},"autonomous_system":{"$ref":"#/components/schemas/ocsfv1.3.0AutonomousSystem","nullable":true,"description":"Any pertinent autonomous system information related to an indicator or OSINT analysis."},"comment":{"type":"string","nullable":true,"description":"Analyst commentary or source commentary about an indicator or OSINT analysis."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence of an indicator being malicious and/or pertinent, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source or analyst."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.3.0Osint_ConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of collected information related to the OSINT or how pertinent an indicator or analysis is to a specific event or finding. A low confidence means that the information collected or analysis conducted lacked detail or is not accurate enough to qualify an indicator as fully malicious."},"email":{"$ref":"#/components/schemas/ocsfv1.3.0Email","nullable":true,"description":"Any email information pertinent to an indicator or OSINT analysis."},"email_auth":{"$ref":"#/components/schemas/ocsfv1.3.0EmailAuth","nullable":true,"description":"Any email authentication information pertinent to an indicator or OSINT analysis."},"kill_chain":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0KillChainPhase"},"nullable":true,"description":"Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT analysis."},"location":{"$ref":"#/components/schemas/ocsfv1.3.0Location","nullable":true,"description":"Any pertinent geolocation information related to an indicator or OSINT analysis."},"name":{"type":"string","nullable":true,"description":"The name of the entity."},"signatures":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0DigitalSignature"},"nullable":true,"description":"Any digital signatures or hashes related to an indicator or OSINT analysis."},"src_url":{"$ref":"#/components/schemas/ocsfv1.3.0URLString","nullable":true,"description":"The source URL of an indicator or OSINT analysis, e.g., a URL back to a TIP, report, or otherwise."},"subdomains":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Any pertinent subdomain information - such as those generated by a Domain Generation Algorithm - related to an indicator or OSINT analysis."},"tlp":{"$ref":"#/components/schemas/ocsfv1.3.0Osint_Tlp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/tlp/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Traffic Light Protocol"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" was created to facilitate greater sharing of potentially sensitive information and more effective collaboration. TLP provides a simple and intuitive schema for indicating with whom potentially sensitive information can be shared."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":"The OSINT indicator type."},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0Osint_TypeId","description":"The OSINT indicator type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the entity."},"value":{"type":"string","description":"The actual indicator value in scope, e.g., a SHA-256 hash hexdigest or a domain name."},"vendor_name":{"type":"string","nullable":true,"description":"The vendor name of a tool which generates intelligence or provides indicators."},"vulnerabilities":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Vulnerability"},"nullable":true,"description":"Any vulnerabilities related to an indicator or OSINT analysis."},"whois":{"$ref":"#/components/schemas/ocsfv1.3.0Whois","nullable":true,"description":"Any pertinent WHOIS information related to an indicator or OSINT analysis."}},"required":["type_id","value"]}},"components/schemas/ocsfv1.3.0Osint_ConfidenceId":{"id":"components/schemas/ocsfv1.3.0Osint_ConfidenceId","kind":"json-schema","title":"ocsfv1.3.0Osint_ConfidenceId","data":{"title":"ocsfv1.3.0Osint_ConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OsintConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Osint_Tlp":{"id":"components/schemas/ocsfv1.3.0Osint_Tlp","kind":"json-schema","title":"ocsfv1.3.0Osint_Tlp","data":{"title":"ocsfv1.3.0Osint_Tlp","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OsintTlp is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only spread this on a need-to-know basis within their organization and its clients. Note that TLP:AMBER+STRICT restricts sharing to the organization only. Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risk to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may share TLP:AMBER information with members of their own organization and its clients, but only on a need-to-know basis to protect their organization and its clients and prevent further harm. Note: if the source wants to restrict sharing to the organization only, they must specify TLP:AMBER+STRICT."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure, recipients can only spread this on a need-to-know basis within their organization and its clients. Note that TLP:AMBER+STRICT restricts sharing to the organization only. Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risk to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may share TLP:AMBER information with members of their own organization and its clients, but only on a need-to-know basis to protect their organization and its clients and prevent further harm. Note: if the source wants to restrict sharing to the organization only, they must specify TLP:AMBER+STRICT."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the world, there is no limit on disclosure. Sources may use TLP:CLEAR when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be shared without restriction."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can spread this within their community. Sources may use TLP:GREEN when information is useful to increase awareness within their wider community. Recipients may share TLP:GREEN information with peers and partner organizations within their community, but not via publicly accessible channels. TLP:GREEN information may not be shared outside of the community. Note: when “community” is not defined, assume the cybersecurity/defense community."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"RED - RED: TLP:RED is for the eyes and ears of individual recipients only, no further disclosure. Sources may use TLP:RED when information cannot be effectively acted upon without significant risk for the privacy, reputation, or operations of the organizations involved. Recipients may therefore not share TLP:RED information with anyone else. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Osint_TypeId":{"id":"components/schemas/ocsfv1.3.0Osint_TypeId","kind":"json-schema","title":"ocsfv1.3.0Osint_TypeId","data":{"title":"ocsfv1.3.0Osint_TypeId","type":"integer","description":"OsintTypeId is an enum, and the following values are allowed.\n0 - Unknown: The indicator type is ambiguous or there is not a related indicator for the OSINT object.\n1 - IPAddress: An IPv4 or IPv6 address.\n2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial domain.\n3 - Hostname: A hostname or computer name.\n4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc. generated from a file, malware sample, request header, or otherwise.\n5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator (URI).\n6 - UserAgent: A User Agent typically seen in HTTP request headers.\n7 - DigitalCertificate: The serial number, fingerprint, or full content of an X.509 digital certificate.\n8 - Email: The contents of an email or any related information to an email object.\n9 - EmailAddress: An email address.\n10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a weakness, exploit, bug, or misconfiguration.\n99 - Other: The indicator type is not directly listed."}},"components/schemas/ocsfv1.3.0Package":{"id":"components/schemas/ocsfv1.3.0Package","kind":"json-schema","title":"ocsfv1.3.0Package","data":{"title":"ocsfv1.3.0Package","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Software Package object describes details about a software package. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:SoftwarePackage"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"architecture":{"type":"string","nullable":true,"description":"Architecture is a shorthand name describing the type of computer hardware the packaged software is meant to run on."},"cpe_name":{"type":"string","nullable":true,"description":"The Common Platform Enumeration (CPE) name for the software package."},"epoch":{"type":"integer","nullable":true,"description":"The software package epoch. Epoch is a way to define weighted dependencies based on version numbers."},"hash":{"$ref":"#/components/schemas/ocsfv1.3.0Fingerprint","nullable":true,"description":"Cryptographic hash to identify the binary instance of a software component. This can include any component such file, package, or library."},"license":{"type":"string","nullable":true,"description":"The software license applied to this package."},"name":{"type":"string","description":"The software package name."},"purl":{"type":"string","nullable":true,"description":"A purl is a URL string used to identify and locate a software package in a mostly universal and uniform way across programming languages, package managers, packaging conventions, tools, APIs and databases."},"release":{"type":"string","nullable":true,"description":"Release is the number of times a version of the software has been packaged."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of software package, normalized to the caption of the type_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0Package_TypeId","nullable":true,"description":"The type of software package."},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor who published the software package."},"version":{"type":"string","description":"The software package version."}},"required":["name","version"]}},"components/schemas/ocsfv1.3.0Package_TypeId":{"id":"components/schemas/ocsfv1.3.0Package_TypeId","kind":"json-schema","title":"ocsfv1.3.0Package_TypeId","data":{"title":"ocsfv1.3.0Package_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"PackageTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Application: An application software package."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - OperatingSystem: An operating system software package."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Policy":{"id":"components/schemas/ocsfv1.3.0Policy","kind":"json-schema","title":"ocsfv1.3.0Policy","data":{"title":"ocsfv1.3.0Policy","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Policy object describes the policies that are applicable. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Policy attributes provide traceability to the operational state of the security product at the time that the event was captured, facilitating forensics, troubleshooting, and policy tuning/adjustments."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"desc":{"type":"string","nullable":true,"description":"The description of the policy."},"group":{"$ref":"#/components/schemas/ocsfv1.3.0Group","nullable":true,"description":"The policy group."},"is_applied":{"type":"boolean","nullable":true,"description":"A determination if the content of a policy was applied to a target or request, or not."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The policy name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IAM Policy"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"A unique identifier of the policy instance."},"version":{"type":"string","nullable":true,"description":"The policy version number."}}}},"components/schemas/ocsfv1.3.0Process":{"id":"components/schemas/ocsfv1.3.0Process","kind":"json-schema","title":"ocsfv1.3.0Process","data":{"title":"ocsfv1.3.0Process","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Process object describes a running instance of a launched program. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Process/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:Process"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"auid":{"type":"integer","nullable":true,"description":"The audit user assigned at login by the audit subsystem."},"cmd_line":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full command line used to launch an application, service, process, or job. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ssh user@10.0.0.10"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". If the command line is unavailable or missing, the empty string "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"''"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is to be used."},"children":[],"type":"text"}],"type":"paragraph"}]},"container":{"$ref":"#/components/schemas/ocsfv1.3.0Container","nullable":true,"description":"The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd."},"created_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the process was created/started."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the process was created/started."},"egid":{"type":"integer","nullable":true,"description":"The effective group under which this process is running."},"euid":{"type":"integer","nullable":true,"description":"The effective user under which this process is running."},"file":{"$ref":"#/components/schemas/ocsfv1.3.0File","nullable":true,"description":"The process file object."},"group":{"$ref":"#/components/schemas/ocsfv1.3.0Group","nullable":true,"description":"The group under which this process is running."},"integrity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The process integrity level, normalized to the caption of the integrity_id value. In the case of 'Other', it is defined by the event source (Windows only)."},"children":[],"type":"text"}],"type":"paragraph"}]},"integrity_id":{"$ref":"#/components/schemas/ocsfv1.3.0Process_IntegrityId","nullable":true,"description":"The normalized identifier of the process integrity level (Windows only)."},"lineage":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The lineage of the process, represented by a list of paths for each ancestor process. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"['/usr/sbin/sshd', '/usr/bin/bash', '/usr/bin/whoami']"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"loaded_modules":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of loaded module names."},"name":{"$ref":"#/components/schemas/ocsfv1.3.0ProcessName","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The friendly name of the process, for example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notepad++"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"namespace_pid":{"type":"integer","nullable":true,"description":"If running under a process namespace (such as in a container), the process identifier within that process namespace."},"parent_process":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The parent process of this process object. It is recommended to only populate this field for the first process object, to prevent deep nesting."},"pid":{"type":"integer","nullable":true,"description":"The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process."},"sandbox":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps."},"children":[],"type":"text"}],"type":"paragraph"}]},"session":{"$ref":"#/components/schemas/ocsfv1.3.0Session","nullable":true,"description":"The user session under which this process is running."},"terminated_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the process was terminated."},"terminated_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the process was terminated."},"tid":{"type":"integer","nullable":true,"description":"The Identifier of the thread associated with the event, as returned by the operating system."},"uid":{"type":"string","nullable":true,"description":"A unique identifier for this process assigned by the producer (tool).  Facilitates correlation of a process event with other events for that process."},"user":{"$ref":"#/components/schemas/ocsfv1.3.0User","nullable":true,"description":"The user under which this process is running."},"xattributes":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"An unordered collection of zero or more name/value pairs that represent a process extended attribute."}}}},"components/schemas/ocsfv1.3.0Process_IntegrityId":{"id":"components/schemas/ocsfv1.3.0Process_IntegrityId","kind":"json-schema","title":"ocsfv1.3.0Process_IntegrityId","data":{"title":"ocsfv1.3.0Process_IntegrityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ProcessIntegrityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The integrity level is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Untrusted"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - System"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Protected"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The integrity level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"integrity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Product":{"id":"components/schemas/ocsfv1.3.0Product","kind":"json-schema","title":"ocsfv1.3.0Product","data":{"title":"ocsfv1.3.0Product","type":"object","description":"The Product object describes characteristics of a software product.","properties":{"cpe_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Platform Enumeration (CPE) name as described by ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://nvd.nist.gov/products/cpe"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpe:/a:apple:safari:16.2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"distribution_mode":{"type":"string","nullable":true,"description":"Indicates the source from which the app was installed, such as the app store."},"feature":{"$ref":"#/components/schemas/ocsfv1.3.0Feature","nullable":true,"description":"The feature that reported the event."},"lang":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The two letter lower case language codes, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/ISO_639-1"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ISO 639-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"en"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (English), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"de"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (German), or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"fr"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (French)."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","nullable":true,"description":"The name of the product."},"path":{"type":"string","nullable":true,"description":"The installation path of the product."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the product."},"url_string":{"$ref":"#/components/schemas/ocsfv1.3.0URLString","nullable":true,"description":"The URL pointing towards the product."},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor of the product."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The version of the product, as defined by the event source. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2013.1.3-beta"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"workload":{"type":"string","nullable":true,"description":"The product workload associated with the event."}}}},"components/schemas/ocsfv1.3.0RelatedEvent":{"id":"components/schemas/ocsfv1.3.0RelatedEvent","kind":"json-schema","title":"ocsfv1.3.0RelatedEvent","data":{"title":"ocsfv1.3.0RelatedEvent","type":"object","description":"The Related Event object describes an OCSF event related to a finding.","properties":{"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects describing the tactics, techniques & sub-techniques identified by a security control or finding."},"children":[],"type":"text"}],"type":"paragraph"}]},"kill_chain":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0KillChainPhase"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Cyber Kill Chain®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" provides a detailed description of each phase and its associated activities within the broader context of a cyber attack."},"children":[],"type":"text"}],"type":"paragraph"}]},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"product_uid":{"type":"string","nullable":true,"description":"The unique identifier of the product that reported the related event."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of the related event, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Process Activity: Launch."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of the related OCSF event, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Process Activity: Launch."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"type_uid":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the related OCSF event type. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"100701."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the related OCSF event. This value must be equal to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"metadata.uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in the corresponding related event."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["uid"]}},"components/schemas/ocsfv1.3.0Remediation":{"id":"components/schemas/ocsfv1.3.0Remediation","kind":"json-schema","title":"ocsfv1.3.0Remediation","data":{"title":"ocsfv1.3.0Remediation","type":"object","description":"The Remediation object describes the recommended remediation steps to address identified issue(s).","properties":{"desc":{"type":"string","description":"The description of the remediation strategy."},"kb_article_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0KbArticle"},"nullable":true,"description":"A list of KB articles or patches related to an endpoint. A KB Article contains metadata that describes the patch or an update."},"kb_articles":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The KB article/s related to the entity. A KB Article contains metadata that describes the patch or an update."},"references":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of supporting URL/s, references that help describe the remediation strategy."}},"required":["desc"]}},"components/schemas/ocsfv1.3.0Reputation":{"id":"components/schemas/ocsfv1.3.0Reputation","kind":"json-schema","title":"ocsfv1.3.0Reputation","data":{"title":"ocsfv1.3.0Reputation","type":"object","description":"The Reputation object describes the reputation/risk score of an entity (e.g. device, user, domain).","properties":{"base_score":{"type":"number","format":"double","description":"The reputation score as reported by the event source."},"provider":{"type":"string","nullable":true,"description":"The provider of the reputation information."},"score":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The reputation score, normalized to the caption of the score_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"score_id":{"$ref":"#/components/schemas/ocsfv1.3.0Reputation_ScoreId","description":"The normalized reputation score identifier."}},"required":["base_score","score_id"]}},"components/schemas/ocsfv1.3.0Reputation_ScoreId":{"id":"components/schemas/ocsfv1.3.0Reputation_ScoreId","kind":"json-schema","title":"ocsfv1.3.0Reputation_ScoreId","data":{"title":"ocsfv1.3.0Reputation_ScoreId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ReputationScoreId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The reputation score is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - VerySafe: Long history of good behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Safe: Consistently good behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - ProbablySafe: Reasonable history of good behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - LeansSafe: Starting to establish a history of normal behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - MaynotbeSafe: No established history of normal behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - ExerciseCaution: Starting to establish a history of suspicious or risky behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Risky: A site with a history of suspicious or risky behavior. (spam, scam, potentially unwanted software, potentially malicious)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - PossiblyMalicious: Strong possibility of maliciousness."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - ProbablyMalicious: Indicators of maliciousness."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Malicious: Proven evidence of maliciousness."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The reputation score is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"rep_score"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Request":{"id":"components/schemas/ocsfv1.3.0Request","kind":"json-schema","title":"ocsfv1.3.0Request","data":{"title":"ocsfv1.3.0Request","type":"object","description":"The Request Elements object describes characteristics of an API request.","properties":{"containers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Container"},"nullable":true,"description":"When working with containerized applications, the set of containers which write to the standard the output of a particular logging driver. For example, this may be the set of containers involved in handling api requests and responses for a containerized application."},"data":{"nullable":true,"description":"The additional data that is associated with the api request."},"flags":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of communication flags, normalized to the captions of the flag_ids values. In the case of 'Other', they are defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","description":"The unique request identifier."}},"required":["uid"]}},"components/schemas/ocsfv1.3.0ResourceDetails":{"id":"components/schemas/ocsfv1.3.0ResourceDetails","kind":"json-schema","title":"ocsfv1.3.0ResourceDetails","data":{"title":"ocsfv1.3.0ResourceDetails","type":"object","description":"The Resource Details object describes details about resources that were affected by the activity/event.","properties":{"agent_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Agent"},"nullable":true,"description":"A list of agent objects associated with a device, endpoint, or resource."},"cloud_partition":{"type":"string","nullable":true,"description":"The canonical cloud partition name to which the region is assigned (e.g. AWS Partitions: aws, aws-cn, aws-us-gov)."},"criticality":{"type":"string","nullable":true,"description":"The criticality of the resource as defined by the event source."},"data":{"nullable":true,"description":"Additional data describing the resource."},"group":{"$ref":"#/components/schemas/ocsfv1.3.0Group","nullable":true,"description":"The name of the related resource group."},"ip":{"$ref":"#/components/schemas/ocsfv1.3.0IPAddress","nullable":true,"description":"The IP address associated with the resource."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels/tags associated to a resource."},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The timestamp when the resource was last observed or reported."},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the resource was last observed or reported."},"mac":{"$ref":"#/components/schemas/ocsfv1.3.0MACAddress","nullable":true,"description":"The MAC address associated with the resource."},"name":{"type":"string","nullable":true,"description":"The name of the resource."},"namespace":{"type":"string","nullable":true,"description":"The namespace is useful when similar entities exist that you need to keep separate."},"os_type":{"type":"string","nullable":true,"description":"The type of operating system running on the resource."},"owner":{"$ref":"#/components/schemas/ocsfv1.3.0User","nullable":true,"description":"The identity of the service or user account that owns the resource."},"region":{"type":"string","nullable":true,"description":"The cloud region of the resource."},"src_url":{"$ref":"#/components/schemas/ocsfv1.3.0URLString","nullable":true,"description":"The URL of the resource in the event sources system."},"type":{"type":"string","nullable":true,"description":"The resource type as defined by the event source."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the resource."},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor."},"vendor_uuid":{"type":"string","nullable":true,"description":"The UUID of the vendor."},"version":{"type":"string","nullable":true,"description":"The version of the resource. For example 1.2.3."}}}},"components/schemas/ocsfv1.3.0Response":{"id":"components/schemas/ocsfv1.3.0Response","kind":"json-schema","title":"ocsfv1.3.0Response","data":{"title":"ocsfv1.3.0Response","type":"object","description":"The Response Elements object describes characteristics of an API response.","properties":{"code":{"type":"integer","nullable":true,"description":"The numeric response sent to a request."},"containers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Container"},"nullable":true,"description":"When working with containerized applications, the set of containers which write to the standard the output of a particular logging driver. For example, this may be the set of containers involved in handling api requests and responses for a containerized application."},"data":{"nullable":true,"description":"The additional data that is associated with the api response."},"error":{"type":"string","nullable":true,"description":"Error Code"},"error_message":{"type":"string","nullable":true,"description":"Error Message"},"flags":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of communication flags, normalized to the captions of the flag_ids values. In the case of 'Other', they are defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."}}}},"components/schemas/ocsfv1.3.0Rule":{"id":"components/schemas/ocsfv1.3.0Rule","kind":"json-schema","title":"ocsfv1.3.0Rule","data":{"title":"ocsfv1.3.0Rule","type":"object","description":"The Rule object describes characteristics of a rule associated with a policy or an event.","properties":{"category":{"type":"string","nullable":true,"description":"The rule category."},"desc":{"type":"string","nullable":true,"description":"The description of the rule that generated the event."},"name":{"type":"string","nullable":true,"description":"The name of the rule that generated the event."},"type":{"type":"string","nullable":true,"description":"The rule type."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the rule that generated the event."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The rule version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.3.0San":{"id":"components/schemas/ocsfv1.3.0San","kind":"json-schema","title":"ocsfv1.3.0San","data":{"title":"ocsfv1.3.0San","type":"object","description":"The Subject Alternative name (SAN) object describes a SAN secured by a digital certificate","properties":{"name":{"type":"string","description":"Name of SAN (e.g. The actual IP Address or domain.)"},"type":{"type":"string","description":"Type descriptor of SAN (e.g. IP Address/domain/etc.)"}},"required":["name","type"]}},"components/schemas/ocsfv1.3.0Scan":{"id":"components/schemas/ocsfv1.3.0Scan","kind":"json-schema","title":"ocsfv1.3.0Scan","data":{"title":"ocsfv1.3.0Scan","type":"object","description":"The Scan object describes characteristics of a proactive scan.","properties":{"name":{"type":"string","nullable":true,"description":"The administrator-supplied or application-generated name of the scan. For example: \"Home office weekly user database scan\", \"Scan folders for viruses\", \"Full system virus scan\""},"targets":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Hosts or IP addresses targeted by the scan."},"type":{"type":"string","nullable":true,"description":"The type of scan."},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0Scan_TypeId","description":"The type id of the scan."},"uid":{"type":"string","nullable":true,"description":"The application-defined unique identifier assigned to an instance of a scan."}},"required":["type_id"]}},"components/schemas/ocsfv1.3.0Scan_TypeId":{"id":"components/schemas/ocsfv1.3.0Scan_TypeId","kind":"json-schema","title":"ocsfv1.3.0Scan_TypeId","data":{"title":"ocsfv1.3.0Scan_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ScanTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Manual: The scan was manually initiated by the user or administrator."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Scheduled: The scan was started based on scheduler."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - UpdatedContent: The scan was triggered by a content update."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - QuarantinedItems: The scan was triggered by newly quarantined items."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - AttachedMedia: The scan was triggered by the attachment of removable media."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - UserLogon: The scan was started due to a user logon."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - ELAM: The scan was triggered by an Early Launch Anti-Malware (ELAM) detection."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The scan type id is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Service":{"id":"components/schemas/ocsfv1.3.0Service","kind":"json-schema","title":"ocsfv1.3.0Service","data":{"title":"ocsfv1.3.0Service","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Service object describes characteristics of a service, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. AWS EC2. "},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels associated with the service."},"name":{"type":"string","nullable":true,"description":"The name of the service."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the service."},"version":{"type":"string","nullable":true,"description":"The version of the service."}}}},"components/schemas/ocsfv1.3.0Session":{"id":"components/schemas/ocsfv1.3.0Session","kind":"json-schema","title":"ocsfv1.3.0Session","data":{"title":"ocsfv1.3.0Session","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Session object describes details about an authenticated session. e.g. Session Creation Time, Session Issuer. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Session/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:Session"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"count":{"type":"integer","nullable":true,"description":"The number of identical sessions spawned from the same source IP, destination IP, application, and content/threat type seen over a period of time."},"created_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the session was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the session was created."},"credential_uid":{"type":"string","nullable":true,"description":"The unique identifier of the user's credential. For example, AWS Access Key ID."},"expiration_reason":{"type":"string","nullable":true,"description":"The reason which triggered the session expiration."},"expiration_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The session expiration time."},"expiration_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The session expiration time."},"is_mfa":{"type":"boolean","nullable":true,"description":"Indicates whether Multi Factor Authentication was used during authentication."},"is_remote":{"type":"boolean","nullable":true,"description":"The indication of whether the session is remote."},"is_vpn":{"type":"boolean","nullable":true,"description":"The indication of whether the session is a VPN session."},"issuer":{"type":"string","nullable":true,"description":"The identifier of the session issuer."},"terminal":{"type":"string","nullable":true,"description":"The Pseudo Terminal associated with the session. Ex: the tty or pts value."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the session."},"uid_alt":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The alternate unique identifier of the session. e.g. AWS ARN - "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"arn:aws:sts::123344444444:assumed-role/Admin/example-session"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uuid":{"type":"string","nullable":true,"description":"The universally unique identifier of the session."}}}},"components/schemas/ocsfv1.3.0Sharing":{"id":"components/schemas/ocsfv1.3.0Sharing","kind":"json-schema","title":"ocsfv1.3.0Sharing","data":{"title":"ocsfv1.3.0Sharing","type":"object","description":"The Sharing object encompasses information about how and with whom a resource was shared.","properties":{"actors":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Actor"},"nullable":true,"description":"The actor(s) with whom the resource has been shared. Note that with the addition of groups to the Actor object, sharing with a group can be represented by an Actor object with an empty user field and a populated groups field."},"anonymous":{"type":"boolean","nullable":true,"description":"True if anonymous access is enabled for sharing."},"can_reshare":{"type":"boolean","nullable":true,"description":"True if the recipients have permission to re-share the resource."},"link_id":{"type":"string","nullable":true,"description":"Unique ID of a sharing link."},"permissions":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0SharingPermission"},"nullable":true,"description":"List of permissions granted."},"scope":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The scope, normalized to the caption of the scope_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"scope_id":{"$ref":"#/components/schemas/ocsfv1.3.0Sharing_ScopeId","nullable":true,"description":"The normalized identifier of the sharing scope."},"sharing_action":{"type":"string","nullable":true,"description":"Describes the nature of a sharing action, such as creating a link for others to access a resource."}}}},"components/schemas/ocsfv1.3.0Sharing_ScopeId":{"id":"components/schemas/ocsfv1.3.0Sharing_ScopeId","kind":"json-schema","title":"ocsfv1.3.0Sharing_ScopeId","data":{"title":"ocsfv1.3.0Sharing_ScopeId","type":"integer","description":"SharingScopeId is an enum, and the following values are allowed.\n0 - Unknown: The scope is unknown.\n1 - User: User scope.\n2 - Group: Group scope.\n3 - Tenant: Tenant scope.\n4 - Organization: Organization scope.\n5 - World: World scope.\n99 - Other: The scope is not mapped."}},"components/schemas/ocsfv1.3.0SharingPermission":{"id":"components/schemas/ocsfv1.3.0SharingPermission","kind":"json-schema","title":"ocsfv1.3.0SharingPermission","data":{"title":"ocsfv1.3.0SharingPermission","type":"object","description":"The Sharing Permission type represents the permissions granted to recipients via a Sharing object.","properties":{"sharing_permission_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The sharing permission type, normalized to the caption of the sharing_permission_type_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"sharing_permission_type_id":{"$ref":"#/components/schemas/ocsfv1.3.0SharingPermission_SharingPermissionTypeId","description":"The normalized identifier of the sharing permission type."}},"required":["sharing_permission_type_id"]}},"components/schemas/ocsfv1.3.0SharingPermission_SharingPermissionTypeId":{"id":"components/schemas/ocsfv1.3.0SharingPermission_SharingPermissionTypeId","kind":"json-schema","title":"ocsfv1.3.0SharingPermission_SharingPermissionTypeId","data":{"title":"ocsfv1.3.0SharingPermission_SharingPermissionTypeId","type":"integer","description":"SharingPermissionSharingPermissionTypeId is an enum, and the following values are allowed.\n0 - Unknown: The sharing permission type is unknown.\n1 - View: View permission.\n2 - Modify: Modify permission.\n99 - Other: The sharing permission type is not mapped."}},"components/schemas/ocsfv1.3.0SubTechnique":{"id":"components/schemas/ocsfv1.3.0SubTechnique","kind":"json-schema","title":"ocsfv1.3.0SubTechnique","data":{"title":"ocsfv1.3.0SubTechnique","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE ATT&CK® Sub Technique object describes the sub technique ID and/or name associated to an attack, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the attack sub technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Scanning IP Blocks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.3.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The versioned permalink of the attack sub technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://attack.mitre.org/versions/v14/techniques/T1595/001/"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the attack sub technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"T1595.001"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.3.0Tactic":{"id":"components/schemas/ocsfv1.3.0Tactic","kind":"json-schema","title":"ocsfv1.3.0Tactic","data":{"title":"ocsfv1.3.0Tactic","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE ATT&CK® Tactic object describes the tactic ID and/or name that is associated to an attack, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The tactic name that is associated with the attack technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Reconnaissance"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.3.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The versioned permalink of the attack tactic, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://attack.mitre.org/versions/v14/tactics/TA0043/"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The tactic ID that is associated with the attack technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TA0043"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.3.0Technique":{"id":"components/schemas/ocsfv1.3.0Technique","kind":"json-schema","title":"ocsfv1.3.0Technique","data":{"title":"ocsfv1.3.0Technique","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE ATT&CK® Technique object describes the technique ID and/or name associated to an attack, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the attack technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Active Scanning"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.3.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The versioned permalink of the attack technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://attack.mitre.org/versions/v14/techniques/T1595/"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the attack technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"T1595"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.3.0Ticket":{"id":"components/schemas/ocsfv1.3.0Ticket","kind":"json-schema","title":"ocsfv1.3.0Ticket","data":{"title":"ocsfv1.3.0Ticket","type":"object","description":"The Ticket object represents ticket in the customer's systems like Salesforce, jira etc.","properties":{"src_url":{"$ref":"#/components/schemas/ocsfv1.3.0URLString","nullable":true,"description":"The url of a ticket in the ticket system."},"title":{"type":"string","nullable":true,"description":"The title of the ticket."},"type":{"type":"string","nullable":true,"description":"The linked ticket type determines whether the ticket is internal or in an external ticketing system."},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0Ticket_TypeId","nullable":true,"description":"The normalized identifier for the ticket type."},"uid":{"type":"string","nullable":true,"description":"Unique ticket identifier like ticket id."}}}},"components/schemas/ocsfv1.3.0Ticket_TypeId":{"id":"components/schemas/ocsfv1.3.0Ticket_TypeId","kind":"json-schema","title":"ocsfv1.3.0Ticket_TypeId","data":{"title":"ocsfv1.3.0Ticket_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TicketTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Internal"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - External"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Timespan":{"id":"components/schemas/ocsfv1.3.0Timespan","kind":"json-schema","title":"ocsfv1.3.0Timespan","data":{"title":"ocsfv1.3.0Timespan","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Time Span object represents different time period durations. If a timespan is fractional, i.e. crosses one period, e.g. a week and 3 days, more than one may may be populated since each member is of integral type. In that case "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"duration":{"type":"integer","nullable":true,"description":"The duration of the time span in milliseconds."},"duration_days":{"type":"integer","nullable":true,"description":"The duration of the time span in days."},"duration_hours":{"type":"integer","nullable":true,"description":"The duration of the time span in hours."},"duration_mins":{"type":"integer","nullable":true,"description":"The duration of the time span in minutes."},"duration_months":{"type":"integer","nullable":true,"description":"The duration of the time span in months."},"duration_secs":{"type":"integer","nullable":true,"description":"The duration of the time span in seconds."},"duration_weeks":{"type":"integer","nullable":true,"description":"The duration of the time span in weeks."},"duration_years":{"type":"integer","nullable":true,"description":"The duration of the time span in years."},"type":{"type":"string","nullable":true,"description":"The type of time span duration the object represents."},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0Timespan_TypeId","nullable":true,"description":"The normalized identifier for the time span duration type."}}}},"components/schemas/ocsfv1.3.0Timespan_TypeId":{"id":"components/schemas/ocsfv1.3.0Timespan_TypeId","kind":"json-schema","title":"ocsfv1.3.0Timespan_TypeId","data":{"title":"ocsfv1.3.0Timespan_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TimespanTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Milliseconds"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Seconds"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Minutes"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Hours"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Days"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Weeks"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Months"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Years"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Tls":{"id":"components/schemas/ocsfv1.3.0Tls","kind":"json-schema","title":"ocsfv1.3.0Tls","data":{"title":"ocsfv1.3.0Tls","type":"object","description":"The Transport Layer Security (TLS) object describes the negotiated TLS protocol used for secure communications over an establish network connection.","properties":{"alert":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The integer value of TLS alert if present. The alerts are defined in the TLS specification in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc2246"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-2246"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"certificate":{"$ref":"#/components/schemas/ocsfv1.3.0Certificate","nullable":true,"description":"The certificate object containing information about the digital certificate."},"certificate_chain":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The Chain of Certificate Serial Numbers field provides a chain of Certificate Issuer Serial Numbers leading to the Root Certificate Issuer."},"cipher":{"type":"string","nullable":true,"description":"The negotiated cipher suite."},"client_ciphers":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The client cipher suites that were exchanged during the TLS handshake negotiation."},"extension_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0TlsExtension"},"nullable":true,"description":"The list of TLS extensions."},"handshake_dur":{"type":"integer","nullable":true,"description":"The amount of total time for the TLS handshake to complete after the TCP connection is established, including client-side delays, in milliseconds."},"ja3_hash":{"$ref":"#/components/schemas/ocsfv1.3.0Fingerprint","nullable":true,"description":"The MD5 hash of a JA3 string."},"ja3s_hash":{"$ref":"#/components/schemas/ocsfv1.3.0Fingerprint","nullable":true,"description":"The MD5 hash of a JA3S string."},"key_length":{"type":"integer","nullable":true,"description":"The length of the encryption key."},"sans":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0San"},"nullable":true,"description":"The list of subject alternative names that are secured by a specific certificate."},"server_ciphers":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The server cipher suites that were exchanged during the TLS handshake negotiation."},"sni":{"type":"string","nullable":true,"description":" The Server Name Indication (SNI) extension sent by the client."},"tls_extension_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0TlsExtension"},"nullable":true,"description":"The list of TLS extensions."},"version":{"type":"string","description":"The TLS protocol version."}},"required":["version"]}},"components/schemas/ocsfv1.3.0TlsExtension":{"id":"components/schemas/ocsfv1.3.0TlsExtension","kind":"json-schema","title":"ocsfv1.3.0TlsExtension","data":{"title":"ocsfv1.3.0TlsExtension","type":"object","description":"The TLS Extension object describes additional attributes that extend the base Transport Layer Security (TLS) object.","properties":{"data":{"nullable":true,"description":"The data contains information specific to the particular extension type."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The TLS extension type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Server Name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0TlsExtension_TypeId","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The TLS extension type identifier. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc8446#page-35"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Transport Layer Security (TLS) extension page"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["type_id"]}},"components/schemas/ocsfv1.3.0TlsExtension_TypeId":{"id":"components/schemas/ocsfv1.3.0TlsExtension_TypeId","kind":"json-schema","title":"ocsfv1.3.0TlsExtension_TypeId","data":{"title":"ocsfv1.3.0TlsExtension_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TlsExtensionTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - name: The Server Name Indication extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - fragment_length: The Maximum Fragment Length Negotiation extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - request: The Certificate Status Request extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - groups: The Supported Groups extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - algorithms: The Signature Algorithms extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - srtp: The Use SRTP data protection extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - heartbeat: The Heartbeat extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - layer_protocol_negotiation: The Application-Layer Protocol Negotiation extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - certificate_timestamp: The Signed Certificate Timestamp extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - certificate_type: The Client Certificate Type extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - certificate_type: The Server Certificate Type extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - padding: The Padding extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"41 - shared_key: The Pre Shared Key extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"42 - data: The Early Data extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"43 - versions: The Supported Versions extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"44 - cookie: The Cookie extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"45 - key_exchange_modes: The Pre-Shared Key Exchange Modes extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"47 - authorities: The Certificate Authorities extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"48 - filters: The OID Filters extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"49 - handshake_auth: The Post-Handshake Client Authentication extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"50 - algorithms_cert: The Signature Algorithms extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"51 - share: The Key Share extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Url":{"id":"components/schemas/ocsfv1.3.0Url","kind":"json-schema","title":"ocsfv1.3.0Url","data":{"title":"ocsfv1.3.0Url","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Uniform Resource Locator(URL) object describes the characteristics of a URL. Defined in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc1738"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC 1738"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:URL/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:URL"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"categories":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Website categorization names, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"category_ids"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" enum values."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_ids":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Url_CategoryIds"},"nullable":true,"description":"The Website categorization identifiers."},"domain":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The domain portion of the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://sub.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"hostname":{"$ref":"#/components/schemas/ocsfv1.3.0Hostname","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL host as extracted from the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"www.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"www.example.com/download/trouble"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"path":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL path as extracted from the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"/download/trouble"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"www.example.com/download/trouble"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"port":{"$ref":"#/components/schemas/ocsfv1.3.0Port","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL port. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"80"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"query_string":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The query portion of the URL. For example: the query portion of the URL "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http://www.example.com/search?q=bad&sort=date"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"q=bad&sort=date"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"resource_type":{"type":"string","nullable":true,"description":"The context in which a resource was retrieved in a web request."},"scheme":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The scheme portion of the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ftp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"sftp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"subdomain":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The subdomain portion of the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"sub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://sub.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"sub2.sub1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://sub2.sub1.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"url_string":{"$ref":"#/components/schemas/ocsfv1.3.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL string. See RFC 1738. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http://www.example.com/download/trouble.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Note: The URL path should not populate the URL string."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.3.0Url_CategoryIds":{"id":"components/schemas/ocsfv1.3.0Url_CategoryIds","kind":"json-schema","title":"ocsfv1.3.0Url_CategoryIds","data":{"title":"ocsfv1.3.0Url_CategoryIds","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UrlCategoryIds is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The Domain/URL category is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - MatureContent"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Pornography"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - SexEducation"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Swimsuit"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Nudity"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Extreme"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Questionable_Illegal"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Gambling"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Hate_Racism"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Weapons"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - Abortion"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Hacking"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Phishing"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Entertainment"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Economy"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Belief"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Alcohol"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - Tobacco"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - ControlledSubstances"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - ChildPornography"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Education"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"29 - CharitableOrganizations"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"30 - Culture"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"31 - FinancialServices"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"32 - Trading"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"33 - Games"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"34 - Legal"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"35 - Military"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"36 - SocialAdvocacy"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"37 - Health"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"38 - Internet"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"40 - Portals"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"43 - Malnets"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"44 - Botnets"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"45 - Careers"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"46 - Media"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"47 - Dating"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"49 - Reference"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"50 - PotentiallyAdult"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"51 - IM_SMS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"52 - Email"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"53 - Forums"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"54 - Religion"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"55 - SocialNetworking"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"56 - Sharing"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"57 - RemoteAccessTools"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"58 - Shopping"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"59 - Auctions"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"60 - RealEstate"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"61 - DailyLiving"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"63 - PersonalSites"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"64 - Dining_Food"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"65 - Recreation"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"66 - Travel"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"67 - Vehicles"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"68 - Jokes"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"71 - SoftwareDownloads"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"83 - to_Peer_P2P_"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"84 - VideoClips"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"85 - BusinessApplications"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"86 - ProxyAvoidance"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"87 - ForKids"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"88 - Analytics"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"89 - WebHosting"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"90 - Uncategorized"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"92 - Suspicious"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"93 - SexualExpression"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"95 - Translation"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"96 - Viewable_Infrastructure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"97 - ContentServers"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"98 - Placeholders"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The Domain/URL category is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"categories"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"101 - Spam"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"102 - PotentiallyUnwantedSoftware"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"103 - DynamicDNSHost"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"106 - Card_Invitations"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"107 - Informational"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"108 - InformationSecurity"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"109 - InternetConnectedDevices"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"110 - InternetTelephony"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"111 - OnlineMeetings"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"112 - MediaSharing"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"113 - AudioStreams"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"114 - VideoStreams"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"118 - CopyrightConcerns"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"121 - Marijuana"},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0User":{"id":"components/schemas/ocsfv1.3.0User","kind":"json-schema","title":"ocsfv1.3.0User","data":{"title":"ocsfv1.3.0User","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The User object describes the characteristics of a user/person or a security principal. Defined by D3FEND "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"d3f:UserAccount"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"account":{"$ref":"#/components/schemas/ocsfv1.3.0Account","nullable":true,"description":"The user's account or the account associated with the user."},"credential_uid":{"type":"string","nullable":true,"description":"The unique identifier of the user's credential. For example, AWS Access Key ID."},"domain":{"type":"string","nullable":true,"description":"The domain where the user is defined. For example: the LDAP or Active Directory domain."},"email_addr":{"$ref":"#/components/schemas/ocsfv1.3.0EmailAddress","nullable":true,"description":"The user's primary email address."},"full_name":{"type":"string","nullable":true,"description":"The full name of the person, as per the LDAP Common Name attribute (cn)."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Group"},"nullable":true,"description":"The administrative groups to which the user belongs."},"has_mfa":{"type":"boolean","nullable":true,"description":"The user has a multi-factor or secondary-factor device assigned."},"ldap_person":{"$ref":"#/components/schemas/ocsfv1.3.0LdapPerson","nullable":true,"description":"The additional LDAP attributes that describe a person."},"leave_events":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0LeaveEvent"},"nullable":true,"description":"Leave of absence events associated with the person. May include current, past, and future leaves."},"mfa_status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The multi-factor authentication status, normalized to the caption of the mfa_status_id value. In the case of 'Other', it is defined by the data source."},"children":[],"type":"text"}],"type":"paragraph"}]},"mfa_status_id":{"$ref":"#/components/schemas/ocsfv1.3.0User_MfaStatusId","nullable":true,"description":"The normalized identifier of the user's multi-factor authentication status."},"name":{"$ref":"#/components/schemas/ocsfv1.3.0UserName","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The username. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"janedoe1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"on_leave":{"type":"boolean","nullable":true,"description":"True if the person is currently on a leave of absence."},"org":{"$ref":"#/components/schemas/ocsfv1.3.0Organization","nullable":true,"description":"Organization and org unit related to the user."},"privileges":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The user's privileges."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.3.0User_RiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"type":{"type":"string","nullable":true,"description":"The type of the user. For example, System, AWS IAM User, etc."},"type_id":{"$ref":"#/components/schemas/ocsfv1.3.0User_TypeId","nullable":true,"description":"The account type identifier."},"uid":{"type":"string","nullable":true,"description":"The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN."},"uid_alt":{"type":"string","nullable":true,"description":"The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID."},"user_status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The user status, normalized to the caption of the user_status_id value. In the case of 'Other', it is defined by the data source."},"children":[],"type":"text"}],"type":"paragraph"}]},"user_status_id":{"$ref":"#/components/schemas/ocsfv1.3.0User_UserStatusId","nullable":true,"description":"The normalized identifier of the user's status."}}}},"components/schemas/ocsfv1.3.0User_MfaStatusId":{"id":"components/schemas/ocsfv1.3.0User_MfaStatusId","kind":"json-schema","title":"ocsfv1.3.0User_MfaStatusId","data":{"title":"ocsfv1.3.0User_MfaStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UserMfaStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Enabled: Multi-factor authentication is enabled for this user."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - NotEnabled: TMulti-factor authentication is off for this user."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Enforced: Multi-factor authentication is enabled and there is a policy that requires it for this user."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"user_status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0User_RiskLevelId":{"id":"components/schemas/ocsfv1.3.0User_RiskLevelId","kind":"json-schema","title":"ocsfv1.3.0User_RiskLevelId","data":{"title":"ocsfv1.3.0User_RiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UserRiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0User_TypeId":{"id":"components/schemas/ocsfv1.3.0User_TypeId","kind":"json-schema","title":"ocsfv1.3.0User_TypeId","data":{"title":"ocsfv1.3.0User_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UserTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - User: Regular user account."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Admin: Admin/root user account."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - System: System account. For example, Windows computer accounts with a trailing dollar sign ($)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0User_UserStatusId":{"id":"components/schemas/ocsfv1.3.0User_UserStatusId","kind":"json-schema","title":"ocsfv1.3.0User_UserStatusId","data":{"title":"ocsfv1.3.0User_UserStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UserUserStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Active: The user is active."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Pending: The user is not active, pending either user or admin action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Locked: The user account is locked requiring either time or intervention to unlock."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Suspended: The user account is suspended."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deprovisioned: The user account has been deprovisioned and is pending removal."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"user_status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0Vulnerability":{"id":"components/schemas/ocsfv1.3.0Vulnerability","kind":"json-schema","title":"ocsfv1.3.0Vulnerability","data":{"title":"ocsfv1.3.0Vulnerability","type":"object","description":"The vulnerability is an unintended characteristic of a computing component or system configuration that multiplies the risk of an adverse event or a loss occurring either due to accidental exposure, deliberate attack, or conflict with new system components.","properties":{"advisory":{"$ref":"#/components/schemas/ocsfv1.3.0Advisory","nullable":true,"description":"Detail about the security advisory, that is used to publicly disclose cybersecurity vulnerabilities by a vendor."},"affected_code":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0AffectedCode"},"nullable":true,"description":"List of Affected Code objects that describe details about code blocks identified as vulnerable."},"affected_packages":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0AffectedPackage"},"nullable":true,"description":"List of software packages identified as affected by a vulnerability/vulnerabilities."},"category":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The category of a vulnerability or weakness, as reported by the source tool, such as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Container Security"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Open Source Security"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cve":{"$ref":"#/components/schemas/ocsfv1.3.0Cve","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Vulnerabilities and Exposures ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cve.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVE"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}]},"cwe":{"$ref":"#/components/schemas/ocsfv1.3.0Cwe","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CWE object represents a weakness in a software system that can be exploited by a threat actor to perform an attack. The CWE object is based on the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Common Weakness Enumeration (CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" catalog."},"children":[],"type":"text"}],"type":"paragraph"}]},"desc":{"type":"string","nullable":true,"description":"The description of the vulnerability."},"first_seen_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the vulnerability was first observed."},"first_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the vulnerability was first observed."},"fix_available":{"type":"boolean","nullable":true,"description":"Indicates if a fix is available for the reported vulnerability."},"is_exploit_available":{"type":"boolean","nullable":true,"description":"Indicates if an exploit or a PoC (proof-of-concept) is available for the reported vulnerability."},"is_fix_available":{"type":"boolean","nullable":true,"description":"Indicates if a fix is available for the reported vulnerability."},"kb_article_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0KbArticle"},"nullable":true,"description":"A list of KB articles or patches related to an endpoint. A KB Article contains metadata that describes the patch or an update."},"kb_articles":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The KB article/s related to the entity. A KB Article contains metadata that describes the patch or an update."},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time when the vulnerability was most recently observed."},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the vulnerability was most recently observed."},"packages":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Package"},"nullable":true,"description":"List of vulnerable packages as identified by the security product"},"references":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of reference URLs with additional information about the vulnerability."},"related_vulnerabilities":{"type":"array","items":{"type":"string"},"nullable":true,"description":"List of vulnerabilities that are related to this vulnerability."},"remediation":{"$ref":"#/components/schemas/ocsfv1.3.0Remediation","nullable":true,"description":"The remediation recommendations on how to mitigate the identified vulnerability."},"severity":{"type":"string","nullable":true,"description":"The vendor assigned severity of the vulnerability."},"title":{"type":"string","nullable":true,"description":"A title or a brief phrase summarizing the discovered vulnerability."},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor that identified the vulnerability."},"xattributes":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"An unordered collection of zero or more name/value pairs that represent a vulnerability's extended attributes and are specific to the event source."}}}},"components/schemas/ocsfv1.3.0WebResource":{"id":"components/schemas/ocsfv1.3.0WebResource","kind":"json-schema","title":"ocsfv1.3.0WebResource","data":{"title":"ocsfv1.3.0WebResource","type":"object","description":"The Web Resource object describes characteristics of a web resource that was affected by the activity/event.","properties":{"data":{"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Details of the web resource, e.g, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"file"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" details, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"search"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" results or application-defined resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"desc":{"type":"string","nullable":true,"description":"Description of the web resource."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels/tags associated to a resource."},"name":{"type":"string","nullable":true,"description":"The name of the web resource."},"type":{"type":"string","nullable":true,"description":"The web resource type as defined by the event source."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the web resource."},"url_string":{"$ref":"#/components/schemas/ocsfv1.3.0URLString","nullable":true,"description":"The URL pointing towards the source of the web resource."}}}},"components/schemas/ocsfv1.3.0Whois":{"id":"components/schemas/ocsfv1.3.0Whois","kind":"json-schema","title":"ocsfv1.3.0Whois","data":{"title":"ocsfv1.3.0Whois","type":"object","description":"The resources of a WHOIS record for a given domain. This can include domain names, IP address blocks, autonomous system information, and/or contact and registration information for a domain.","properties":{"autonomous_system":{"$ref":"#/components/schemas/ocsfv1.3.0AutonomousSystem","nullable":true,"description":"The autonomous system information associated with a domain."},"created_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"When the domain was registered or WHOIS entry was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"When the domain was registered or WHOIS entry was created."},"dnssec_status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized value of dnssec_status_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"dnssec_status_id":{"$ref":"#/components/schemas/ocsfv1.3.0Whois_DnssecStatusId","nullable":true,"description":"Describes the normalized status of DNS Security Extensions (DNSSEC) for a domain."},"domain":{"type":"string","nullable":true,"description":"The name of the domain."},"domain_contacts":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0DomainContact"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Domain Contact"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects."},"children":[],"type":"text"}],"type":"paragraph"}]},"email_addr":{"$ref":"#/components/schemas/ocsfv1.3.0EmailAddress","nullable":true,"description":"The email address for the registrar's abuse contact"},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"When the WHOIS record was last updated or seen at."},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"When the WHOIS record was last updated or seen at."},"name_servers":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A collection of name servers related to a domain registration or other record."},"phone_number":{"type":"string","nullable":true,"description":"The phone number for the registrar's abuse contact"},"registrar":{"type":"string","nullable":true,"description":"The domain registrar."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The status of a domain and its ability to be transferred, e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"clientTransferProhibited"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"subdomains":{"type":"array","items":{"type":"string"},"nullable":true,"description":"An array of subdomain strings. Can be used to collect several subdomains such as those from Domain Generation Algorithms (DGAs)."},"subnet":{"$ref":"#/components/schemas/ocsfv1.3.0Subnet","nullable":true,"description":"The IP address block (CIDR) associated with a domain."}}}},"components/schemas/ocsfv1.3.0Whois_DnssecStatusId":{"id":"components/schemas/ocsfv1.3.0Whois_DnssecStatusId","kind":"json-schema","title":"ocsfv1.3.0Whois_DnssecStatusId","data":{"title":"ocsfv1.3.0Whois_DnssecStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"WhoisDnssecStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Signed: The related domain enables the signing of DNS records using DNSSEC."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Unsigned: The related domain does not enable the signing of DNS records using DNSSEC."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The DNSSEC status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dnssec_status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0processactivityActionId":{"id":"components/schemas/ocsfv1.3.0processactivityActionId","kind":"json-schema","title":"ocsfv1.3.0processactivityActionId","data":{"title":"ocsfv1.3.0processactivityActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Count', 'Uncorrected', 'Isolated', 'Quarantined' or 'Exonerated'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action was not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0processactivityActivityId":{"id":"components/schemas/ocsfv1.3.0processactivityActivityId","kind":"json-schema","title":"ocsfv1.3.0processactivityActivityId","data":{"title":"ocsfv1.3.0processactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Launch"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Terminate"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Open"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Inject"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - SetUserID"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0processactivityCategoryUid":{"id":"components/schemas/ocsfv1.3.0processactivityCategoryUid","kind":"json-schema","title":"ocsfv1.3.0processactivityCategoryUid","data":{"title":"ocsfv1.3.0processactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n1 - SystemActivity: System Activity events."}},"components/schemas/ocsfv1.3.0processactivityClassUid":{"id":"components/schemas/ocsfv1.3.0processactivityClassUid","kind":"json-schema","title":"ocsfv1.3.0processactivityClassUid","data":{"title":"ocsfv1.3.0processactivityClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n1007 - ProcessActivity: Process Activity events report when a process launches, injects, opens or terminates another process, successful or otherwise."}},"components/schemas/ocsfv1.3.0processactivityDispositionId":{"id":"components/schemas/ocsfv1.3.0processactivityDispositionId","kind":"json-schema","title":"ocsfv1.3.0processactivityDispositionId","data":{"title":"ocsfv1.3.0processactivityDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0processactivityInjectionTypeId":{"id":"components/schemas/ocsfv1.3.0processactivityInjectionTypeId","kind":"json-schema","title":"ocsfv1.3.0processactivityInjectionTypeId","data":{"title":"ocsfv1.3.0processactivityInjectionTypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"InjectionTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The injection type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - RemoteThread"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - LoadLibrary"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - QueueAPC"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The injection type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"injection_type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0processactivityProcessActivity":{"id":"components/schemas/ocsfv1.3.0processactivityProcessActivity","kind":"json-schema","title":"ocsfv1.3.0processactivityProcessActivity","data":{"title":"ocsfv1.3.0processactivityProcessActivity","type":"object","description":"Process Activity events report when a process launches, injects, opens or terminates another process, successful or otherwise.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.3.0processactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. Dispositions conform to an action of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed' or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Denied' in most cases. Note that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"99"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Other' is not an option. No action would equate to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0processactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The actor that performed the activity on the target "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"process"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example, the process that started a new process or injected code into another process."},"children":[],"type":"text"}],"type":"paragraph"}]},"actual_permissions":{"type":"integer","nullable":true,"description":"The permissions that were granted to the in a platform-native format."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects describing the tactics, techniques & sub-techniques identified by a security control or finding."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"System Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0processactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0processactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","description":"An addressable device, computer system or host."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.3.0processactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"exit_code":{"type":"integer","nullable":true,"description":"The exit code reported by a process when it terminates. The convention is that zero indicates success and any non-zero exit code indicates that some error occurred."},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.3.0FirewallRule","nullable":true,"description":"The firewall rule that triggered the event."},"injection_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The process injection method, normalized to the caption of the injection_type_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"injection_type_id":{"$ref":"#/components/schemas/ocsfv1.3.0processactivityInjectionTypeId","nullable":true,"description":"The normalized identifier of the process injection method."},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"module":{"$ref":"#/components/schemas/ocsfv1.3.0Module","nullable":true,"description":"The module that was injected by the actor process."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"process":{"$ref":"#/components/schemas/ocsfv1.3.0Process","description":"The process that was launched, injected into, opened, or terminated."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"requested_permissions":{"type":"integer","nullable":true,"description":"The permissions mask that were requested by the process."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0processactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0processactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0processactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","actor","category_uid","class_uid","device","metadata","process","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0processactivitySeverityId":{"id":"components/schemas/ocsfv1.3.0processactivitySeverityId","kind":"json-schema","title":"ocsfv1.3.0processactivitySeverityId","data":{"title":"ocsfv1.3.0processactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0processactivityStatusId":{"id":"components/schemas/ocsfv1.3.0processactivityStatusId","kind":"json-schema","title":"ocsfv1.3.0processactivityStatusId","data":{"title":"ocsfv1.3.0processactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0processactivityTypeUid":{"id":"components/schemas/ocsfv1.3.0processactivityTypeUid","kind":"json-schema","title":"ocsfv1.3.0processactivityTypeUid","data":{"title":"ocsfv1.3.0processactivityTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n100700 - Unknown\n100701 - Launch\n100702 - Terminate\n100703 - Open\n100704 - Inject\n100705 - SetUserID\n100799 - Other"}},"components/schemas/ocsfv1.3.0scanactivityActivityId":{"id":"components/schemas/ocsfv1.3.0scanactivityActivityId","kind":"json-schema","title":"ocsfv1.3.0scanactivityActivityId","data":{"title":"ocsfv1.3.0scanactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Started: The scan was started."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Completed: The scan was completed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Cancelled: The scan was cancelled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - DurationViolation: The allocated scan time was insufficient to complete the requested scan."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - PauseViolation: The scan was paused, either by the user or by program constraints (e.g. scans that are suspended during certain time intervals), and not resumed within the allotted time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Error: The scan could not be completed due to an internal error."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Paused: The scan was paused."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Resumed: The scan was resumed from the pause point."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restarted: The scan restarted from the beginning of the file enumeration."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Delayed: The user delayed the scan."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0scanactivityCategoryUid":{"id":"components/schemas/ocsfv1.3.0scanactivityCategoryUid","kind":"json-schema","title":"ocsfv1.3.0scanactivityCategoryUid","data":{"title":"ocsfv1.3.0scanactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n6 - ApplicationActivity: Application Activity events report detailed information about the behavior of applications and services."}},"components/schemas/ocsfv1.3.0scanactivityClassUid":{"id":"components/schemas/ocsfv1.3.0scanactivityClassUid","kind":"json-schema","title":"ocsfv1.3.0scanactivityClassUid","data":{"title":"ocsfv1.3.0scanactivityClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n6007 - ScanActivity: Scan events report the start, completion, and results of a scan job. The scan event includes the number of items that were scanned and the number of detections that were resolved."}},"components/schemas/ocsfv1.3.0scanactivityScanActivity":{"id":"components/schemas/ocsfv1.3.0scanactivityScanActivity","kind":"json-schema","title":"ocsfv1.3.0scanactivityScanActivity","data":{"title":"ocsfv1.3.0scanactivityScanActivity","type":"object","description":"Scan events report the start, completion, and results of a scan job. The scan event includes the number of items that were scanned and the number of detections that were resolved.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0scanactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"agent_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Agent"},"nullable":true,"description":"The agents that were used to scan the devices."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Application Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0scanactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0scanactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"command_uid":{"type":"string","nullable":true,"description":"The command identifier that is associated with this scan event.  This ID uniquely identifies the proactive scan command, e.g., if remotely initiated."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"An addressable device, computer system or host."},"duration":{"type":"integer","nullable":true,"description":"The duration of the scan"},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of the scan job."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of the scan job."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"num_detections":{"type":"integer","nullable":true,"description":"The number of detections."},"num_files":{"type":"integer","nullable":true,"description":"The number of files scanned."},"num_folders":{"type":"integer","nullable":true,"description":"The number of folders scanned."},"num_hosts":{"type":"integer","nullable":true,"description":"The number of hosts that were scanned."},"num_network_items":{"type":"integer","nullable":true,"description":"The number of network items scanned."},"num_processes":{"type":"integer","nullable":true,"description":"The number of processes scanned."},"num_registry_items":{"type":"integer","nullable":true,"description":"The number of registry items scanned."},"num_resolutions":{"type":"integer","nullable":true,"description":"The number of items that were resolved."},"num_skipped_items":{"type":"integer","nullable":true,"description":"The number of skipped items."},"num_trusted_items":{"type":"integer","nullable":true,"description":"The number of trusted items."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"policy":{"$ref":"#/components/schemas/ocsfv1.3.0Policy","nullable":true,"description":"The policy associated with this Scan event; required if the scan was initiated by a policy."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"scan":{"$ref":"#/components/schemas/ocsfv1.3.0Scan","description":"The Scan object describes characteristics of the scan job."},"schedule_uid":{"type":"string","nullable":true,"description":"The unique identifier of the schedule associated with a scan job."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0scanactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of the scan job."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of the scan job."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0scanactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"total":{"type":"integer","nullable":true,"description":"The total number of items that were scanned; zero if no items were scanned."},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0scanactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","scan","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0scanactivitySeverityId":{"id":"components/schemas/ocsfv1.3.0scanactivitySeverityId","kind":"json-schema","title":"ocsfv1.3.0scanactivitySeverityId","data":{"title":"ocsfv1.3.0scanactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0scanactivityStatusId":{"id":"components/schemas/ocsfv1.3.0scanactivityStatusId","kind":"json-schema","title":"ocsfv1.3.0scanactivityStatusId","data":{"title":"ocsfv1.3.0scanactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0scanactivityTypeUid":{"id":"components/schemas/ocsfv1.3.0scanactivityTypeUid","kind":"json-schema","title":"ocsfv1.3.0scanactivityTypeUid","data":{"title":"ocsfv1.3.0scanactivityTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n600700 - Unknown\n600701 - Started: The scan was started.\n600702 - Completed: The scan was completed.\n600703 - Cancelled: The scan was cancelled.\n600704 - DurationViolation: The allocated scan time was insufficient to complete the requested scan.\n600705 - PauseViolation: The scan was paused, either by the user or by program constraints (e.g. scans that are suspended during certain time intervals), and not resumed within the allotted time.\n600706 - Error: The scan could not be completed due to an internal error.\n600707 - Paused: The scan was paused.\n600708 - Resumed: The scan was resumed from the pause point.\n600709 - Restarted: The scan restarted from the beginning of the file enumeration.\n600710 - Delayed: The user delayed the scan.\n600799 - Other"}},"components/schemas/ocsfv1.3.0scheduledjobactivityActionId":{"id":"components/schemas/ocsfv1.3.0scheduledjobactivityActionId","kind":"json-schema","title":"ocsfv1.3.0scheduledjobactivityActionId","data":{"title":"ocsfv1.3.0scheduledjobactivityActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Count', 'Uncorrected', 'Isolated', 'Quarantined' or 'Exonerated'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action was not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0scheduledjobactivityActivityId":{"id":"components/schemas/ocsfv1.3.0scheduledjobactivityActivityId","kind":"json-schema","title":"ocsfv1.3.0scheduledjobactivityActivityId","data":{"title":"ocsfv1.3.0scheduledjobactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Create"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Update"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Delete"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Enable"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Disable"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Start"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0scheduledjobactivityCategoryUid":{"id":"components/schemas/ocsfv1.3.0scheduledjobactivityCategoryUid","kind":"json-schema","title":"ocsfv1.3.0scheduledjobactivityCategoryUid","data":{"title":"ocsfv1.3.0scheduledjobactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n1 - SystemActivity: System Activity events."}},"components/schemas/ocsfv1.3.0scheduledjobactivityClassUid":{"id":"components/schemas/ocsfv1.3.0scheduledjobactivityClassUid","kind":"json-schema","title":"ocsfv1.3.0scheduledjobactivityClassUid","data":{"title":"ocsfv1.3.0scheduledjobactivityClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n1006 - ScheduledJobActivity: Scheduled Job Activity events report activities related to scheduled jobs or tasks."}},"components/schemas/ocsfv1.3.0scheduledjobactivityDispositionId":{"id":"components/schemas/ocsfv1.3.0scheduledjobactivityDispositionId","kind":"json-schema","title":"ocsfv1.3.0scheduledjobactivityDispositionId","data":{"title":"ocsfv1.3.0scheduledjobactivityDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0scheduledjobactivityScheduledJobActivity":{"id":"components/schemas/ocsfv1.3.0scheduledjobactivityScheduledJobActivity","kind":"json-schema","title":"ocsfv1.3.0scheduledjobactivityScheduledJobActivity","data":{"title":"ocsfv1.3.0scheduledjobactivityScheduledJobActivity","type":"object","description":"Scheduled Job Activity events report activities related to scheduled jobs or tasks.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.3.0scheduledjobactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. Dispositions conform to an action of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed' or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Denied' in most cases. Note that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"99"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Other' is not an option. No action would equate to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0scheduledjobactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The actor that performed the activity on the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"job"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object."},"children":[],"type":"text"}],"type":"paragraph"}]},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects describing the tactics, techniques & sub-techniques identified by a security control or finding."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"System Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0scheduledjobactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0scheduledjobactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","description":"An addressable device, computer system or host."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.3.0scheduledjobactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.3.0FirewallRule","nullable":true,"description":"The firewall rule that triggered the event."},"job":{"$ref":"#/components/schemas/ocsfv1.3.0Job","description":"The job object that pertains to the event."},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0scheduledjobactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0scheduledjobactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0scheduledjobactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","device","job","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0scheduledjobactivitySeverityId":{"id":"components/schemas/ocsfv1.3.0scheduledjobactivitySeverityId","kind":"json-schema","title":"ocsfv1.3.0scheduledjobactivitySeverityId","data":{"title":"ocsfv1.3.0scheduledjobactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0scheduledjobactivityStatusId":{"id":"components/schemas/ocsfv1.3.0scheduledjobactivityStatusId","kind":"json-schema","title":"ocsfv1.3.0scheduledjobactivityStatusId","data":{"title":"ocsfv1.3.0scheduledjobactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0scheduledjobactivityTypeUid":{"id":"components/schemas/ocsfv1.3.0scheduledjobactivityTypeUid","kind":"json-schema","title":"ocsfv1.3.0scheduledjobactivityTypeUid","data":{"title":"ocsfv1.3.0scheduledjobactivityTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n100600 - Unknown\n100601 - Create\n100602 - Update\n100603 - Delete\n100604 - Enable\n100605 - Disable\n100606 - Start\n100699 - Other"}},"components/schemas/ocsfv1.3.0securityfindingActivityId":{"id":"components/schemas/ocsfv1.3.0securityfindingActivityId","kind":"json-schema","title":"ocsfv1.3.0securityfindingActivityId","data":{"title":"ocsfv1.3.0securityfindingActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Create: A security finding was created."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Update: A security finding was updated."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Close: A security finding was closed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0securityfindingCategoryUid":{"id":"components/schemas/ocsfv1.3.0securityfindingCategoryUid","kind":"json-schema","title":"ocsfv1.3.0securityfindingCategoryUid","data":{"title":"ocsfv1.3.0securityfindingCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n2 - Findings: Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products."}},"components/schemas/ocsfv1.3.0securityfindingClassUid":{"id":"components/schemas/ocsfv1.3.0securityfindingClassUid","kind":"json-schema","title":"ocsfv1.3.0securityfindingClassUid","data":{"title":"ocsfv1.3.0securityfindingClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n2001 - SecurityFinding: Security Finding events describe findings, detections, anomalies, alerts and/or actions performed by security products"}},"components/schemas/ocsfv1.3.0securityfindingConfidenceId":{"id":"components/schemas/ocsfv1.3.0securityfindingConfidenceId","kind":"json-schema","title":"ocsfv1.3.0securityfindingConfidenceId","data":{"title":"ocsfv1.3.0securityfindingConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0securityfindingImpactId":{"id":"components/schemas/ocsfv1.3.0securityfindingImpactId","kind":"json-schema","title":"ocsfv1.3.0securityfindingImpactId","data":{"title":"ocsfv1.3.0securityfindingImpactId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ImpactId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized impact is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The impact is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"impact"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0securityfindingRiskLevelId":{"id":"components/schemas/ocsfv1.3.0securityfindingRiskLevelId","kind":"json-schema","title":"ocsfv1.3.0securityfindingRiskLevelId","data":{"title":"ocsfv1.3.0securityfindingRiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0securityfindingSecurityFinding":{"id":"components/schemas/ocsfv1.3.0securityfindingSecurityFinding","kind":"json-schema","title":"ocsfv1.3.0securityfindingSecurityFinding","data":{"title":"ocsfv1.3.0securityfindingSecurityFinding","type":"object","description":"Security Finding events describe findings, detections, anomalies, alerts and/or actions performed by security products","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"analytic":{"$ref":"#/components/schemas/ocsfv1.3.0Analytic","nullable":true,"description":"The analytic technique used to analyze and derive insights from the data or information that led to the finding or conclusion."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The attack object describes the technique and associated tactics as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK Matrix"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"sup","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TM"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingCategoryUid","description":"The category unique identifier of the event."},"cis_csc":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0CisCsc"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CIS Critical Security Controls is a list of top 20 actions and practices an organization’s security team can take on such that cyber attacks or malware, are minimized and prevented."},"children":[],"type":"text"}],"type":"paragraph"}]},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"compliance":{"$ref":"#/components/schemas/ocsfv1.3.0Compliance","nullable":true,"description":"The compliance object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS, NIST etc.) and contains compliance related details."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"data_sources":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of data sources utilized in generation of the finding."},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the affected device/host. It can be used in conjunction with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Affected Resource(s)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. Specific details about an AWS EC2 instance, that is affected by the Finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"evidence":{"nullable":true,"description":"The data the finding exposes to the analyst."},"finding":{"$ref":"#/components/schemas/ocsfv1.3.0Finding","description":"The Finding object provides details about a finding/detection generated by a security tool."},"impact":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"impact_id":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingImpactId","nullable":true,"description":"The normalized impact of the finding."},"impact_score":{"type":"integer","nullable":true,"description":"The impact of the finding, valid range 0-100."},"kill_chain":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0KillChainPhase"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Cyber Kill Chain®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" provides a detailed description of each phase and its associated activities within the broader context of a cyber attack."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"nist":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The NIST Cybersecurity Framework recommendations for managing the cybersecurity risk."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"process":{"$ref":"#/components/schemas/ocsfv1.3.0Process","nullable":true,"description":"The process object."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0ResourceDetails"},"nullable":true,"description":"Describes details about resources that were affected by the activity/event."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"state":{"type":"string","nullable":true,"description":"The normalized state of a security finding."},"state_id":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingStateId","description":"The normalized state identifier of a security finding."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"vulnerabilities":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Vulnerability"},"nullable":true,"description":"This object describes vulnerabilities reported in a security finding."}},"required":["activity_id","category_uid","class_uid","finding","metadata","severity_id","state_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0securityfindingSeverityId":{"id":"components/schemas/ocsfv1.3.0securityfindingSeverityId","kind":"json-schema","title":"ocsfv1.3.0securityfindingSeverityId","data":{"title":"ocsfv1.3.0securityfindingSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0securityfindingStateId":{"id":"components/schemas/ocsfv1.3.0securityfindingStateId","kind":"json-schema","title":"ocsfv1.3.0securityfindingStateId","data":{"title":"ocsfv1.3.0securityfindingStateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - New: The finding is new and yet to be reviewed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - InProgress: The finding is under review."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Suppressed: The finding was reviewed, considered as a false positive and is now suppressed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Resolved: The finding was reviewed and remediated and is now considered resolved."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0securityfindingStatusId":{"id":"components/schemas/ocsfv1.3.0securityfindingStatusId","kind":"json-schema","title":"ocsfv1.3.0securityfindingStatusId","data":{"title":"ocsfv1.3.0securityfindingStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0securityfindingTypeUid":{"id":"components/schemas/ocsfv1.3.0securityfindingTypeUid","kind":"json-schema","title":"ocsfv1.3.0securityfindingTypeUid","data":{"title":"ocsfv1.3.0securityfindingTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n200100 - Unknown\n200101 - Create: A security finding was created.\n200102 - Update: A security finding was updated.\n200103 - Close: A security finding was closed.\n200199 - Other"}},"components/schemas/ocsfv1.3.0softwareinfoActivityId":{"id":"components/schemas/ocsfv1.3.0softwareinfoActivityId","kind":"json-schema","title":"ocsfv1.3.0softwareinfoActivityId","data":{"title":"ocsfv1.3.0softwareinfoActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Log: The discovered information is via a log."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Collect: The discovered information is via a collection process."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0softwareinfoCategoryUid":{"id":"components/schemas/ocsfv1.3.0softwareinfoCategoryUid","kind":"json-schema","title":"ocsfv1.3.0softwareinfoCategoryUid","data":{"title":"ocsfv1.3.0softwareinfoCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects."}},"components/schemas/ocsfv1.3.0softwareinfoClassUid":{"id":"components/schemas/ocsfv1.3.0softwareinfoClassUid","kind":"json-schema","title":"ocsfv1.3.0softwareinfoClassUid","data":{"title":"ocsfv1.3.0softwareinfoClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n5090 - DeviceSoftwareInfo: Device Software Info events report device software data that is either logged or proactively collected."}},"components/schemas/ocsfv1.3.0softwareinfoSeverityId":{"id":"components/schemas/ocsfv1.3.0softwareinfoSeverityId","kind":"json-schema","title":"ocsfv1.3.0softwareinfoSeverityId","data":{"title":"ocsfv1.3.0softwareinfoSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0softwareinfoSoftwareInfo":{"id":"components/schemas/ocsfv1.3.0softwareinfoSoftwareInfo","kind":"json-schema","title":"ocsfv1.3.0softwareinfoSoftwareInfo","data":{"title":"ocsfv1.3.0softwareinfoSoftwareInfo","type":"object","description":"Device Software Info events report device software data that is either logged or proactively collected.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0softwareinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0softwareinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0softwareinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"The device that the software is loaded on."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"product":{"$ref":"#/components/schemas/ocsfv1.3.0Product","description":"The software product that is being discovered."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0softwareinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0softwareinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0softwareinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","product","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.3.0softwareinfoStatusId":{"id":"components/schemas/ocsfv1.3.0softwareinfoStatusId","kind":"json-schema","title":"ocsfv1.3.0softwareinfoStatusId","data":{"title":"ocsfv1.3.0softwareinfoStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0softwareinfoTypeUid":{"id":"components/schemas/ocsfv1.3.0softwareinfoTypeUid","kind":"json-schema","title":"ocsfv1.3.0softwareinfoTypeUid","data":{"title":"ocsfv1.3.0softwareinfoTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n509000 - Unknown\n509001 - Log: The discovered information is via a log.\n509002 - Collect: The discovered information is via a collection process.\n509099 - Other"}},"components/schemas/ocsfv1.3.0useraccessmanagementActivityId":{"id":"components/schemas/ocsfv1.3.0useraccessmanagementActivityId","kind":"json-schema","title":"ocsfv1.3.0useraccessmanagementActivityId","data":{"title":"ocsfv1.3.0useraccessmanagementActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - AssignPrivileges: Assign privileges to a user."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - RevokePrivileges: Revoke privileges from a user."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0useraccessmanagementCategoryUid":{"id":"components/schemas/ocsfv1.3.0useraccessmanagementCategoryUid","kind":"json-schema","title":"ocsfv1.3.0useraccessmanagementCategoryUid","data":{"title":"ocsfv1.3.0useraccessmanagementCategoryUid","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CategoryUid is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - AccessManagement: Identity & Access Management (IAM) events relate to the supervision of the system's authentication and access control model. Examples of such events are the success or failure of authentication, granting of authority, password change, entity change, privileged use etc."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0useraccessmanagementClassUid":{"id":"components/schemas/ocsfv1.3.0useraccessmanagementClassUid","kind":"json-schema","title":"ocsfv1.3.0useraccessmanagementClassUid","data":{"title":"ocsfv1.3.0useraccessmanagementClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n3005 - UserAccessManagement: User Access Management events report management updates to a user's privileges."}},"components/schemas/ocsfv1.3.0useraccessmanagementSeverityId":{"id":"components/schemas/ocsfv1.3.0useraccessmanagementSeverityId","kind":"json-schema","title":"ocsfv1.3.0useraccessmanagementSeverityId","data":{"title":"ocsfv1.3.0useraccessmanagementSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0useraccessmanagementStatusId":{"id":"components/schemas/ocsfv1.3.0useraccessmanagementStatusId","kind":"json-schema","title":"ocsfv1.3.0useraccessmanagementStatusId","data":{"title":"ocsfv1.3.0useraccessmanagementStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0useraccessmanagementTypeUid":{"id":"components/schemas/ocsfv1.3.0useraccessmanagementTypeUid","kind":"json-schema","title":"ocsfv1.3.0useraccessmanagementTypeUid","data":{"title":"ocsfv1.3.0useraccessmanagementTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n300500 - Unknown\n300501 - AssignPrivileges: Assign privileges to a user.\n300502 - RevokePrivileges: Revoke privileges from a user.\n300599 - Other"}},"components/schemas/ocsfv1.3.0useraccessmanagementUserAccess":{"id":"components/schemas/ocsfv1.3.0useraccessmanagementUserAccess","kind":"json-schema","title":"ocsfv1.3.0useraccessmanagementUserAccess","data":{"title":"ocsfv1.3.0useraccessmanagementUserAccess","type":"object","description":"User Access Management events report management updates to a user's privileges.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0useraccessmanagementActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Identity & Access Management"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0useraccessmanagementCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0useraccessmanagementClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"An addressable device, computer system or host."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"http_request":{"$ref":"#/components/schemas/ocsfv1.3.0HttpRequest","nullable":true,"description":"Details about the underlying HTTP request."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"privileges":{"type":"array","items":{"type":"string"},"description":"List of privileges assigned to a user."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"resource":{"$ref":"#/components/schemas/ocsfv1.3.0ResourceDetails","nullable":true,"description":"Resource that the privileges give access to."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0useraccessmanagementSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"Details about the source of the IAM activity."},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0useraccessmanagementStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0useraccessmanagementTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"user":{"$ref":"#/components/schemas/ocsfv1.3.0User","description":"User to which privileges were assigned."}},"required":["activity_id","category_uid","class_uid","metadata","privileges","severity_id","time","type_uid","user"]}},"components/schemas/ocsfv1.3.0vulnerabilityfindingActivityId":{"id":"components/schemas/ocsfv1.3.0vulnerabilityfindingActivityId","kind":"json-schema","title":"ocsfv1.3.0vulnerabilityfindingActivityId","data":{"title":"ocsfv1.3.0vulnerabilityfindingActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Create: A finding was created."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Update: A finding was updated."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Close: A finding was closed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0vulnerabilityfindingCategoryUid":{"id":"components/schemas/ocsfv1.3.0vulnerabilityfindingCategoryUid","kind":"json-schema","title":"ocsfv1.3.0vulnerabilityfindingCategoryUid","data":{"title":"ocsfv1.3.0vulnerabilityfindingCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n2 - Findings: Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products."}},"components/schemas/ocsfv1.3.0vulnerabilityfindingClassUid":{"id":"components/schemas/ocsfv1.3.0vulnerabilityfindingClassUid","kind":"json-schema","title":"ocsfv1.3.0vulnerabilityfindingClassUid","data":{"title":"ocsfv1.3.0vulnerabilityfindingClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n2002 - VulnerabilityFinding: The Vulnerability Finding event is a notification about weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source."}},"components/schemas/ocsfv1.3.0vulnerabilityfindingConfidenceId":{"id":"components/schemas/ocsfv1.3.0vulnerabilityfindingConfidenceId","kind":"json-schema","title":"ocsfv1.3.0vulnerabilityfindingConfidenceId","data":{"title":"ocsfv1.3.0vulnerabilityfindingConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0vulnerabilityfindingSeverityId":{"id":"components/schemas/ocsfv1.3.0vulnerabilityfindingSeverityId","kind":"json-schema","title":"ocsfv1.3.0vulnerabilityfindingSeverityId","data":{"title":"ocsfv1.3.0vulnerabilityfindingSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0vulnerabilityfindingStatusId":{"id":"components/schemas/ocsfv1.3.0vulnerabilityfindingStatusId","kind":"json-schema","title":"ocsfv1.3.0vulnerabilityfindingStatusId","data":{"title":"ocsfv1.3.0vulnerabilityfindingStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - New: The Finding is new and yet to be reviewed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - InProgress: The Finding is under review."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Suppressed: The Finding was reviewed, determined to be benign or a false positive and is now suppressed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Resolved: The Finding was reviewed, remediated and is now considered resolved."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0vulnerabilityfindingTypeUid":{"id":"components/schemas/ocsfv1.3.0vulnerabilityfindingTypeUid","kind":"json-schema","title":"ocsfv1.3.0vulnerabilityfindingTypeUid","data":{"title":"ocsfv1.3.0vulnerabilityfindingTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n200200 - Unknown\n200201 - Create: A finding was created.\n200202 - Update: A finding was updated.\n200203 - Close: A finding was closed.\n200299 - Other"}},"components/schemas/ocsfv1.3.0vulnerabilityfindingVulnerabilityFinding":{"id":"components/schemas/ocsfv1.3.0vulnerabilityfindingVulnerabilityFinding","kind":"json-schema","title":"ocsfv1.3.0vulnerabilityfindingVulnerabilityFinding","data":{"title":"ocsfv1.3.0vulnerabilityfindingVulnerabilityFinding","type":"object","description":"The Vulnerability Finding event is a notification about weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0vulnerabilityfindingActivityId","description":"The normalized identifier of the finding activity."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The finding activity name, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0vulnerabilityfindingCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0vulnerabilityfindingClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"comment":{"type":"string","nullable":true,"description":"A user provided comment about the finding."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.3.0vulnerabilityfindingConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the affected device/host. It can be used in conjunction with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Affected Resource(s)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. Specific details about an AWS EC2 instance, that is affected by the Finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time of the most recent event included in the finding."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the most recent event included in the finding."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"finding_info":{"$ref":"#/components/schemas/ocsfv1.3.0FindingInfo","description":"Describes the supporting information about a generated finding."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"resource":{"$ref":"#/components/schemas/ocsfv1.3.0ResourceDetails","nullable":true,"description":"Describes details about the resource that is affected by the vulnerability/vulnerabilities."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0ResourceDetails"},"nullable":true,"description":"Describes details about the resource/resources that are affected by the vulnerability/vulnerabilities."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0vulnerabilityfindingSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The time of the least recent event included in the finding."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the least recent event included in the finding."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0vulnerabilityfindingStatusId","nullable":true,"description":"The normalized status identifier of the Finding, set by the consumer."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0vulnerabilityfindingTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"vulnerabilities":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Vulnerability"},"description":"This object describes vulnerabilities reported in a security finding."}},"required":["activity_id","category_uid","class_uid","finding_info","metadata","severity_id","time","type_uid","vulnerabilities"]}},"components/schemas/ocsfv1.3.0webresourceaccessactivityActivityId":{"id":"components/schemas/ocsfv1.3.0webresourceaccessactivityActivityId","kind":"json-schema","title":"ocsfv1.3.0webresourceaccessactivityActivityId","data":{"title":"ocsfv1.3.0webresourceaccessactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - AccessGrant: The incoming request has permission to the web resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - AccessDeny: The incoming request does not have permission to the web resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - AccessRevoke: The incoming request's access has been revoked due to security policy enforcements."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - AccessError: An error occurred during processing the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0webresourceaccessactivityCategoryUid":{"id":"components/schemas/ocsfv1.3.0webresourceaccessactivityCategoryUid","kind":"json-schema","title":"ocsfv1.3.0webresourceaccessactivityCategoryUid","data":{"title":"ocsfv1.3.0webresourceaccessactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n6 - ApplicationActivity: Application Activity events report detailed information about the behavior of applications and services."}},"components/schemas/ocsfv1.3.0webresourceaccessactivityClassUid":{"id":"components/schemas/ocsfv1.3.0webresourceaccessactivityClassUid","kind":"json-schema","title":"ocsfv1.3.0webresourceaccessactivityClassUid","data":{"title":"ocsfv1.3.0webresourceaccessactivityClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n6004 - WebResourceAccessActivity: Web Resource Access Activity events describe successful/failed attempts to access a web resource over HTTP."}},"components/schemas/ocsfv1.3.0webresourceaccessactivitySeverityId":{"id":"components/schemas/ocsfv1.3.0webresourceaccessactivitySeverityId","kind":"json-schema","title":"ocsfv1.3.0webresourceaccessactivitySeverityId","data":{"title":"ocsfv1.3.0webresourceaccessactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0webresourceaccessactivityStatusId":{"id":"components/schemas/ocsfv1.3.0webresourceaccessactivityStatusId","kind":"json-schema","title":"ocsfv1.3.0webresourceaccessactivityStatusId","data":{"title":"ocsfv1.3.0webresourceaccessactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.3.0webresourceaccessactivityTypeUid":{"id":"components/schemas/ocsfv1.3.0webresourceaccessactivityTypeUid","kind":"json-schema","title":"ocsfv1.3.0webresourceaccessactivityTypeUid","data":{"title":"ocsfv1.3.0webresourceaccessactivityTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n600400 - Unknown\n600401 - AccessGrant: The incoming request has permission to the web resource.\n600402 - AccessDeny: The incoming request does not have permission to the web resource.\n600403 - AccessRevoke: The incoming request's access has been revoked due to security policy enforcements.\n600404 - AccessError: An error occurred during processing the request.\n600499 - Other"}},"components/schemas/ocsfv1.3.0webresourceaccessactivityWebResourceAccessActivity":{"id":"components/schemas/ocsfv1.3.0webresourceaccessactivityWebResourceAccessActivity","kind":"json-schema","title":"ocsfv1.3.0webresourceaccessactivityWebResourceAccessActivity","data":{"title":"ocsfv1.3.0webresourceaccessactivityWebResourceAccessActivity","type":"object","description":"Web Resource Access Activity events describe successful/failed attempts to access a web resource over HTTP.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0webresourceaccessactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Application Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0webresourceaccessactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0webresourceaccessactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":"An addressable device, computer system or host."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"http_request":{"$ref":"#/components/schemas/ocsfv1.3.0HttpRequest","description":"Details about the underlying HTTP request."},"http_response":{"$ref":"#/components/schemas/ocsfv1.3.0HttpResponse","nullable":true,"description":"Details about the HTTP response, if available."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"proxy":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkProxy","nullable":true,"description":"Details about the proxy service, if available."},"proxy_connection_info":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkConnectionInfo","nullable":true,"description":"The connection information from the proxy server to the remote server."},"proxy_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkProxy","nullable":true,"description":"The proxy (server) in a network connection."},"proxy_http_request":{"$ref":"#/components/schemas/ocsfv1.3.0HttpRequest","nullable":true,"description":"The HTTP Request from the proxy server to the remote server."},"proxy_http_response":{"$ref":"#/components/schemas/ocsfv1.3.0HttpResponse","nullable":true,"description":"The HTTP Response from the remote server to the proxy server."},"proxy_tls":{"$ref":"#/components/schemas/ocsfv1.3.0Tls","nullable":true,"description":"The TLS protocol negotiated between the proxy server and the remote server."},"proxy_traffic":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkTraffic","nullable":true,"description":"The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0webresourceaccessactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.3.0NetworkEndpoint","nullable":true,"description":"Details about the source endpoint of the request."},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0webresourceaccessactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"tls":{"$ref":"#/components/schemas/ocsfv1.3.0Tls","nullable":true,"description":"The Transport Layer Security (TLS) attributes, if available."},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0webresourceaccessactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"web_resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0WebResource"},"description":"Details about the resource that is the target of the activity."}},"required":["activity_id","category_uid","class_uid","http_request","metadata","severity_id","time","type_uid","web_resources"]}},"components/schemas/ocsfv1.4.0EmailAddress":{"id":"components/schemas/ocsfv1.4.0EmailAddress","kind":"json-schema","title":"ocsfv1.4.0EmailAddress","data":{"title":"ocsfv1.4.0EmailAddress","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Email address. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"john_doe@example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0FileName":{"id":"components/schemas/ocsfv1.4.0FileName","kind":"json-schema","title":"ocsfv1.4.0FileName","data":{"title":"ocsfv1.4.0FileName","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"File name. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"text-file.txt"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Hash":{"id":"components/schemas/ocsfv1.4.0Hash","kind":"json-schema","title":"ocsfv1.4.0Hash","data":{"title":"ocsfv1.4.0Hash","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Hash. A unique value that corresponds to the content of the file, image, ja3_hash or hassh found in the schema. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" MD5: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3172ac7e2b55cbb81f04a6e65855a628"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Hostname":{"id":"components/schemas/ocsfv1.4.0Hostname","kind":"json-schema","title":"ocsfv1.4.0Hostname","data":{"title":"ocsfv1.4.0Hostname","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Unique name assigned to a device connected to a computer network. It may be a fully qualified domain name (FQDN). For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"r2-d2.example.com."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":","},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mx.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0IPAddress":{"id":"components/schemas/ocsfv1.4.0IPAddress","kind":"json-schema","title":"ocsfv1.4.0IPAddress","data":{"title":"ocsfv1.4.0IPAddress","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Internet Protocol address (IP address), in either IPv4 or IPv6 format. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"192.168.200.24"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2001:0db8:85a3:0000:0000:8a2e:0370:7334"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0MACAddress":{"id":"components/schemas/ocsfv1.4.0MACAddress","kind":"json-schema","title":"ocsfv1.4.0MACAddress","data":{"title":"ocsfv1.4.0MACAddress","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Media Access Control (MAC) address. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"18:36:F3:98:4F:9A"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Port":{"id":"components/schemas/ocsfv1.4.0Port","kind":"json-schema","title":"ocsfv1.4.0Port","data":{"title":"ocsfv1.4.0Port","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The TCP/UDP port number. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"80"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":","},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"22"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0ProcessName":{"id":"components/schemas/ocsfv1.4.0ProcessName","kind":"json-schema","title":"ocsfv1.4.0ProcessName","data":{"title":"ocsfv1.4.0ProcessName","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Process name. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notepad"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Subnet":{"id":"components/schemas/ocsfv1.4.0Subnet","kind":"json-schema","title":"ocsfv1.4.0Subnet","data":{"title":"ocsfv1.4.0Subnet","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The subnet represented in a CIDR notation, using the format network_address/prefix_length. The network_address can be in either IPv4 or IPv6 format. The prefix length indicates the number of bits used for the network portion, and the remaining bits are available for host addresses within that subnet. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"192.168.1.0/24"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":","},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2001:0db8:85a3:0000::/64"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Timestamp":{"id":"components/schemas/ocsfv1.4.0Timestamp","kind":"json-schema","title":"ocsfv1.4.0Timestamp","data":{"title":"ocsfv1.4.0Timestamp","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1618524549901"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0URLString":{"id":"components/schemas/ocsfv1.4.0URLString","kind":"json-schema","title":"ocsfv1.4.0URLString","data":{"title":"ocsfv1.4.0URLString","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Uniform Resource Locator (URL) string. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http://www.example.com/download/trouble.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0UserName":{"id":"components/schemas/ocsfv1.4.0UserName","kind":"json-schema","title":"ocsfv1.4.0UserName","data":{"title":"ocsfv1.4.0UserName","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User name. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"john_doe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoActionId":{"id":"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoActionId","kind":"json-schema","title":"ocsfv1.4.0cloudresourcesinventoryinfoActionId","data":{"title":"ocsfv1.4.0cloudresourcesinventoryinfoActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Observed: The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Modified: The activity was modified, adjusted, or corrected. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoActivityId":{"id":"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoActivityId","kind":"json-schema","title":"ocsfv1.4.0cloudresourcesinventoryinfoActivityId","data":{"title":"ocsfv1.4.0cloudresourcesinventoryinfoActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Log: The discovered information is via a log."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Collect: The discovered information is via a collection process."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCategoryUid":{"id":"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCategoryUid","kind":"json-schema","title":"ocsfv1.4.0cloudresourcesinventoryinfoCategoryUid","data":{"title":"ocsfv1.4.0cloudresourcesinventoryinfoCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects."}},"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoClassUid":{"id":"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoClassUid","kind":"json-schema","title":"ocsfv1.4.0cloudresourcesinventoryinfoClassUid","data":{"title":"ocsfv1.4.0cloudresourcesinventoryinfoClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n5023 - CloudResourcesInventoryInfo: Cloud Resources Inventory Info events report cloud asset inventory data that is either logged or proactively collected. For example, use this event class when creating an inventory of cloud resource information from a Configuration Management Database (CMDB), Cyber Asset Attack Surface Management (CAASM), direct public cloud service provider APIs, Software-as-a-Service (SaaS) APIs, or otherwise."}},"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo":{"id":"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo","kind":"json-schema","title":"ocsfv1.4.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo","data":{"title":"ocsfv1.4.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo","type":"object","description":"Cloud Resources Inventory Info events report cloud asset inventory data that is either logged or proactively collected. For example, use this event class when creating an inventory of cloud resource information from a Configuration Management Database (CMDB), Cyber Asset Attack Surface Management (CAASM), direct public cloud service provider APIs, Software-as-a-Service (SaaS) APIs, or otherwise.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.4.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign."},"api":{"$ref":"#/components/schemas/ocsfv1.4.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects describing identified tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.4.0Cloud","nullable":true,"description":"Cloud service provider or SaaS platform metadata about the cloud resource(s) that are being discovered by an inventory process."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"container":{"$ref":"#/components/schemas/ocsfv1.4.0Container","nullable":true,"description":"A cloud-based container image or running container discovered by an inventory process."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.4.0Object","nullable":true,"description":"A list of custom fields"},"database":{"$ref":"#/components/schemas/ocsfv1.4.0Database","nullable":true,"description":"A cloud-based database discovered by an inventory process."},"databucket":{"$ref":"#/components/schemas/ocsfv1.4.0Databucket","nullable":true,"description":"A cloud-based data bucket or other object storage discovered by an inventory process."},"device":{"$ref":"#/components/schemas/ocsfv1.4.0Device","nullable":true,"description":"An addressable device, computer system or host."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.4.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"idp":{"$ref":"#/components/schemas/ocsfv1.4.0Idp","nullable":true,"description":"The Identity Provider that is being discovered by an inventory process, or that is related to the cloud resource(s) being discovered by an inventory process."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.4.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"policy":{"$ref":"#/components/schemas/ocsfv1.4.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"region":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cloud region where the resource is located, e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-isof-south-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"eastus2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-central1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", etc."},"children":[],"type":"text"}],"type":"paragraph"}]},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0ResourceDetails"},"nullable":true,"description":"The cloud resource(s) that are being discovered by an inventory process. Use this object if there is not a direct object match in the class."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"table":{"$ref":"#/components/schemas/ocsfv1.4.0Table","nullable":true,"description":"A cloud-based database table discovered by an inventory process."},"time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.4.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoConfidenceId":{"id":"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoConfidenceId","kind":"json-schema","title":"ocsfv1.4.0cloudresourcesinventoryinfoConfidenceId","data":{"title":"ocsfv1.4.0cloudresourcesinventoryinfoConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDispositionId":{"id":"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDispositionId","kind":"json-schema","title":"ocsfv1.4.0cloudresourcesinventoryinfoDispositionId","data":{"title":"ocsfv1.4.0cloudresourcesinventoryinfoDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoRiskLevelId":{"id":"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoRiskLevelId","kind":"json-schema","title":"ocsfv1.4.0cloudresourcesinventoryinfoRiskLevelId","data":{"title":"ocsfv1.4.0cloudresourcesinventoryinfoRiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoSeverityId":{"id":"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoSeverityId","kind":"json-schema","title":"ocsfv1.4.0cloudresourcesinventoryinfoSeverityId","data":{"title":"ocsfv1.4.0cloudresourcesinventoryinfoSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoStatusId":{"id":"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoStatusId","kind":"json-schema","title":"ocsfv1.4.0cloudresourcesinventoryinfoStatusId","data":{"title":"ocsfv1.4.0cloudresourcesinventoryinfoStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTypeUid":{"id":"components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTypeUid","kind":"json-schema","title":"ocsfv1.4.0cloudresourcesinventoryinfoTypeUid","data":{"title":"ocsfv1.4.0cloudresourcesinventoryinfoTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n502300 - Unknown\n502301 - Log: The discovered information is via a log.\n502302 - Collect: The discovered information is via a collection process.\n502399 - Other"}},"components/schemas/ocsfv1.4.0Account":{"id":"components/schemas/ocsfv1.4.0Account","kind":"json-schema","title":"ocsfv1.4.0Account","data":{"title":"ocsfv1.4.0Account","type":"object","description":"The Account object contains details about the account that initiated or performed a specific activity within a system or application. Additionally, the Account object refers to logical Cloud and Software-as-a-Service (SaaS) based containers such as AWS Accounts, Azure Subscriptions, Oracle Cloud Compartments, Google Cloud Projects, and otherwise.","properties":{"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels associated to the account."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the account (e.g. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" GCP Project name "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Linux Account name "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" AWS Account name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}]},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the account."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.4.0Account_TypeId","nullable":true,"description":"The normalized account type identifier."},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the account (e.g. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" AWS Account ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" OCID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" GCP Project ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Azure Subscription ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Google Workspace Customer ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" M365 Tenant UID"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.4.0Account_TypeId":{"id":"components/schemas/ocsfv1.4.0Account_TypeId","kind":"json-schema","title":"ocsfv1.4.0Account_TypeId","data":{"title":"ocsfv1.4.0Account_TypeId","type":"integer","description":"AccountTypeId is an enum, and the following values are allowed.\n0 - Unknown: The account type is unknown.\n1 - LDAPAccount\n2 - WindowsAccount\n3 - AWSIAMUser\n4 - AWSIAMRole\n5 - GCPAccount\n6 - AzureADAccount\n7 - MacOSAccount\n8 - AppleAccount\n9 - LinuxAccount\n10 - AWSAccount\n11 - GCPProject\n12 - OCICompartment\n13 - AzureSubscription\n14 - SalesforceAccount\n15 - GoogleWorkspace\n16 - ServicenowInstance\n17 - M365Tenant\n18 - EmailAccount\n99 - Other: The account type is not mapped."}},"components/schemas/ocsfv1.4.0Actor":{"id":"components/schemas/ocsfv1.4.0Actor","kind":"json-schema","title":"ocsfv1.4.0Actor","data":{"title":"ocsfv1.4.0Actor","type":"object","description":"The Actor object contains details about the user, role, application, service, or process that initiated or performed a specific activity. Note that Actor is not the threat actor of a campaign but may be part of a campaign.","properties":{"actor_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The actor type, normalized to the caption of the actor_type_id value. In the case of 'Other', it is defined by the data source."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor_type_id":{"$ref":"#/components/schemas/ocsfv1.4.0Actor_ActorTypeId","nullable":true,"description":"The normalized identifier of the actor type."},"app_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The client application or service that initiated the activity. This can be in conjunction with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"user"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present.  Note that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"app_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is distinct from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"process"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present."},"children":[],"type":"text"}],"type":"paragraph"}]},"app_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the client application or service that initiated the activity. This can be in conjunction with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"user"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present. Note that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"app_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is distinct from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"process.pid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"process.uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Group"},"nullable":true,"description":"Groups which are pertinent to the action. For example, the team name for Teams, where the user may not necessarily be a member of the group, but it is still relevant to the action taken."},"idp":{"$ref":"#/components/schemas/ocsfv1.4.0Idp","nullable":true,"description":"This object describes details about the Identity Provider used."},"invoked_by":{"type":"string","nullable":true,"description":"The name of the service that invoked the activity as described in the event."},"process":{"$ref":"#/components/schemas/ocsfv1.4.0Process","nullable":true,"description":"The process that initiated the activity."},"session":{"$ref":"#/components/schemas/ocsfv1.4.0Session","nullable":true,"description":"The user session from which the activity was initiated."},"user":{"$ref":"#/components/schemas/ocsfv1.4.0User","nullable":true,"description":"The user that initiated the activity or the user context from which the activity was initiated."}}}},"components/schemas/ocsfv1.4.0Actor_ActorTypeId":{"id":"components/schemas/ocsfv1.4.0Actor_ActorTypeId","kind":"json-schema","title":"ocsfv1.4.0Actor_ActorTypeId","data":{"title":"ocsfv1.4.0Actor_ActorTypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActorActorTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The actor type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Internal: Internal actor."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Guest: Guest actor."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Federated: Federated actor."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The actor type is not mapped. See the actor_type attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Advisory":{"id":"components/schemas/ocsfv1.4.0Advisory","kind":"json-schema","title":"ocsfv1.4.0Advisory","data":{"title":"ocsfv1.4.0Advisory","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Advisory object represents publicly disclosed cybersecurity vulnerabilities defined in a Security advisory. e.g. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Microsoft KB Article, Apple Security Advisory"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"avg_timespan":{"$ref":"#/components/schemas/ocsfv1.4.0Timespan","nullable":true,"description":"The average time to patch."},"bulletin":{"type":"string","nullable":true,"description":"The Advisory bulletin identifier."},"classification":{"type":"string","nullable":true,"description":"The vendors classification of the Advisory."},"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the Advisory record was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the Advisory record was created."},"desc":{"type":"string","nullable":true,"description":"A brief description of the Advisory Record."},"install_state":{"type":"string","nullable":true,"description":"The install state of the Advisory."},"install_state_id":{"$ref":"#/components/schemas/ocsfv1.4.0Advisory_InstallStateId","nullable":true,"description":"The normalized install state ID of the Advisory."},"is_superseded":{"type":"boolean","nullable":true,"description":"The Advisory has been replaced by another."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the Advisory record was last updated."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the Advisory record was last updated."},"os":{"$ref":"#/components/schemas/ocsfv1.4.0Os","nullable":true,"description":"The operating system the Advisory applies to."},"product":{"$ref":"#/components/schemas/ocsfv1.4.0Product","nullable":true,"description":"The product where the vulnerability was discovered."},"references":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of reference URLs with additional information about the vulnerabilities disclosed in the Advisory."},"related_cves":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Cve"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of Common Vulnerabilities and Exposures "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cve.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"(CVE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" identifiers related to the vulnerabilities disclosed in the Advisory."},"children":[],"type":"text"}],"type":"paragraph"}]},"related_cwes":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Cwe"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of Common Weakness Enumeration "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"(CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" identifiers related to the vulnerabilities disclosed in the Advisory."},"children":[],"type":"text"}],"type":"paragraph"}]},"size":{"type":"integer","nullable":true,"description":"The size in bytes for the Advisory. Usually populated for a KB Article patch."},"src_url":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":"The Advisory link from the source vendor."},"title":{"type":"string","nullable":true,"description":"A title or a brief phrase summarizing the Advisory."},"uid":{"type":"string","description":"The unique number assigned to the disclosed vulnerability."}},"required":["uid"]}},"components/schemas/ocsfv1.4.0Advisory_InstallStateId":{"id":"components/schemas/ocsfv1.4.0Advisory_InstallStateId","kind":"json-schema","title":"ocsfv1.4.0Advisory_InstallStateId","data":{"title":"ocsfv1.4.0Advisory_InstallStateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AdvisoryInstallStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized install state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Installed: The item is installed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - NotInstalled: The item is not installed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - InstalledPendingReboot: The item is installed pending reboot operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The install state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"install_state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0AffectedCode":{"id":"components/schemas/ocsfv1.4.0AffectedCode","kind":"json-schema","title":"ocsfv1.4.0AffectedCode","data":{"title":"ocsfv1.4.0AffectedCode","type":"object","description":"The Affected Code object describes details about a code block identified as vulnerable.","properties":{"end_line":{"type":"integer","nullable":true,"description":"The line number of the last line of code block identified as vulnerable."},"file":{"$ref":"#/components/schemas/ocsfv1.4.0File","description":"Details about the file that contains the affected code block."},"owner":{"$ref":"#/components/schemas/ocsfv1.4.0User","nullable":true,"description":"Details about the user that owns the affected file."},"remediation":{"$ref":"#/components/schemas/ocsfv1.4.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"start_line":{"type":"integer","nullable":true,"description":"The line number of the first line of code block identified as vulnerable."}},"required":["file"]}},"components/schemas/ocsfv1.4.0AffectedPackage":{"id":"components/schemas/ocsfv1.4.0AffectedPackage","kind":"json-schema","title":"ocsfv1.4.0AffectedPackage","data":{"title":"ocsfv1.4.0AffectedPackage","type":"object","description":"The Affected Package object describes details about a software package identified as affected by a vulnerability/vulnerabilities.","properties":{"architecture":{"type":"string","nullable":true,"description":"Architecture is a shorthand name describing the type of computer hardware the packaged software is meant to run on."},"cpe_name":{"type":"string","nullable":true,"description":"The Common Platform Enumeration (CPE) name for the software package."},"epoch":{"type":"integer","nullable":true,"description":"The software package epoch. Epoch is a way to define weighted dependencies based on version numbers."},"fixed_in_version":{"type":"string","nullable":true,"description":"The software package version in which a reported vulnerability was patched/fixed."},"hash":{"$ref":"#/components/schemas/ocsfv1.4.0Fingerprint","nullable":true,"description":"Cryptographic hash to identify the binary instance of a software component. This can include any component such file, package, or library."},"license":{"type":"string","nullable":true,"description":"The software license applied to this package."},"name":{"type":"string","description":"The software package name."},"package_manager":{"type":"string","nullable":true,"description":"The software packager manager utilized to manage a package on a system, e.g. npm, yum, dpkg etc."},"path":{"type":"string","nullable":true,"description":"The installation path of the affected package."},"purl":{"type":"string","nullable":true,"description":"A purl is a URL string used to identify and locate a software package in a mostly universal and uniform way across programming languages, package managers, packaging conventions, tools, APIs and databases."},"release":{"type":"string","nullable":true,"description":"Release is the number of times a version of the software has been packaged."},"remediation":{"$ref":"#/components/schemas/ocsfv1.4.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of software package, normalized to the caption of the type_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.4.0AffectedPackage_TypeId","nullable":true,"description":"The type of software package."},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor who published the software package."},"version":{"type":"string","description":"The software package version."}},"required":["name","version"]}},"components/schemas/ocsfv1.4.0AffectedPackage_TypeId":{"id":"components/schemas/ocsfv1.4.0AffectedPackage_TypeId","kind":"json-schema","title":"ocsfv1.4.0AffectedPackage_TypeId","data":{"title":"ocsfv1.4.0AffectedPackage_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AffectedPackageTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Application: An application software package."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - OperatingSystem: An operating system software package."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Agent":{"id":"components/schemas/ocsfv1.4.0Agent","kind":"json-schema","title":"ocsfv1.4.0Agent","data":{"title":"ocsfv1.4.0Agent","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An Agent (also known as a Sensor) is typically installed on an Operating System (OS) and serves as a specialized software component that can be designed to monitor, detect, collect, archive, or take action. These activities and possible actions are defined by the upstream system controlling the Agent and its intended purpose. For instance, an Agent can include Endpoint Detection & Response (EDR) agents, backup/disaster recovery sensors, Application Performance Monitoring or profiling sensors, and similar software."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the agent or sensor. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AWS SSM Agent"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"policies":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Policy"},"nullable":true,"description":"Describes the various policies that may be applied or enforced by an agent or sensor. E.g., Conditional Access, prevention, auto-update, tamper protection, destination configuration, etc."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of the type_id value for the agent or sensor. In the case of 'Other' or 'Unknown', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.4.0Agent_TypeId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized representation of an agent or sensor. E.g., EDR, vulnerability management, APM, backup & recovery, etc."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The UID of the agent or sensor, sometimes known as a Sensor ID or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"aid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid_alt":{"type":"string","nullable":true,"description":"An alternative or contextual identifier for the agent or sensor, such as a configuration, organization, or license UID."},"vendor_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The company or author who created the agent or sensor. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Crowdstrike"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The semantic version of the agent or sensor, e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"7.101.50.0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.4.0Agent_TypeId":{"id":"components/schemas/ocsfv1.4.0Agent_TypeId","kind":"json-schema","title":"ocsfv1.4.0Agent_TypeId","data":{"title":"ocsfv1.4.0Agent_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AgentTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool that provides similar threat detection, anti-malware, anti-ransomware, or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender for Endpoint, Wazuh."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that provides similar data classification, data loss detection, and/or data loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview, Symantec DLP."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Recovery: Any agent or sensor that provides backups, archival, or recovery capabilities. E.g., Azure Backup, AWS Backint Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Observability: Any agent or sensor that provides Application Performance Monitoring (APM), active tracing, profiling, or other observability use cases and optionally forwards the logs. E.g., New Relic Agent, Datadog Agent, Azure Monitor Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - VulnerabilityManagement: Any agent or sensor that provides vulnerability management or scanning capabilities. E.g., Qualys VMDR, Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party storage system such as a data lake or SIEM. E.g., Splunk Universal Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - MobileDeviceManagement: Any agent or sensor responsible for providing Mobile Device Management (MDM) or Mobile Enterprise Management (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - ConfigurationManagement: Any agent or sensor that provides configuration management of a device, such as scanning for software, license management, or applying configurations. E.g., AWS Systems Manager Agent, Flexera, ServiceNow MID Server."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - RemoteAccess: Any agent or sensor that provides remote access capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager Agent, Verkada Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Analytic":{"id":"components/schemas/ocsfv1.4.0Analytic","kind":"json-schema","title":"ocsfv1.4.0Analytic","data":{"title":"ocsfv1.4.0Analytic","type":"object","description":"The Analytic object contains details about the analytic technique used to analyze and derive insights from the data or information that led to the creation of a finding or conclusion.","properties":{"category":{"type":"string","nullable":true,"description":"The analytic category."},"desc":{"type":"string","nullable":true,"description":"The description of the analytic that generated the finding."},"name":{"type":"string","nullable":true,"description":"The name of the analytic that generated the finding."},"related_analytics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Object"},"nullable":true,"description":"Other analytics related to this analytic."},"type":{"type":"string","nullable":true,"description":"The analytic type."},"type_id":{"$ref":"#/components/schemas/ocsfv1.4.0Analytic_TypeId","description":"The analytic type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the analytic that generated the finding."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The analytic version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["type_id"]}},"components/schemas/ocsfv1.4.0Analytic_TypeId":{"id":"components/schemas/ocsfv1.4.0Analytic_TypeId","kind":"json-schema","title":"ocsfv1.4.0Analytic_TypeId","data":{"title":"ocsfv1.4.0Analytic_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AnalyticTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Rule: A Rule in security analytics refers to predefined criteria or conditions set to monitor, alert, or enforce policies, playing a crucial role in access control, threat detection, and regulatory compliance across security systems."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Behavioral: Behavioral analytics focus on monitoring and analyzing user or system actions to identify deviations from established patterns, aiding in the detection of insider threats, fraud, and advanced persistent threats (APTs)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Statistical: Statistical analytics pertains to analyzing data patterns and anomalies using statistical models to predict, detect, and respond to potential threats, enhancing overall security posture through informed decision-making."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - ML_DL_: Learning (ML/DL) encompasses techniques that can \"learn\" from known data to create analytics that generalize to new data. There may be a statistical component to these techniques, but it is not a requirement."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Fingerprinting: Fingerprinting is the technique of collecting detailed system data, including software versions and configurations, to enhance threat detection, data loss prevention (DLP), and endpoint detection and response (EDR) capabilities."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Tagging: Tagging refers to the practice of assigning labels or identifiers to data, users, assets, or activities to monitor, control access, and facilitate incident response across various security domains such as DLP and EDR."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - KeywordMatch: Keyword Match involves scanning content for specific terms to identify sensitive information, potential threats, or policy violations, aiding in DLP and compliance monitoring."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - RegularExpressions: Regular Expressions are used to define complex search patterns for identifying, validating, and extracting specific data sets or threats within digital content, enhancing DLP, EDR, and threat detection mechanisms."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - ExactDataMatch: Exact Data Match is a precise comparison technique used to detect the unauthorized use or exposure of specific, sensitive information, crucial for enforcing DLP policies and protecting against data breaches."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - PartialDataMatch: Partial Data Match involves identifying instances where segments of sensitive information or patterns match, facilitating nuanced DLP and threat detection without requiring complete data conformity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - IndexedDataMatch: Indexed Data Match refers to comparing content against a pre-compiled index of sensitive information to efficiently detect and prevent unauthorized access or breaches, streamlining DLP and compliance efforts."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Api":{"id":"components/schemas/ocsfv1.4.0Api","kind":"json-schema","title":"ocsfv1.4.0Api","data":{"title":"ocsfv1.4.0Api","type":"object","description":"The API, or Application Programming Interface, object represents  information pertaining to an API request and response.","properties":{"group":{"$ref":"#/components/schemas/ocsfv1.4.0Group","nullable":true,"description":"The information pertaining to the API group."},"operation":{"type":"string","description":"Verb/Operation associated with the request"},"request":{"$ref":"#/components/schemas/ocsfv1.4.0Request","nullable":true,"description":"Details pertaining to the API request."},"response":{"$ref":"#/components/schemas/ocsfv1.4.0Response","nullable":true,"description":"Details pertaining to the API response."},"service":{"$ref":"#/components/schemas/ocsfv1.4.0Service","nullable":true,"description":"The information pertaining to the API service."},"version":{"type":"string","nullable":true,"description":"The version of the API service."}},"required":["operation"]}},"components/schemas/ocsfv1.4.0Attack":{"id":"components/schemas/ocsfv1.4.0Attack","kind":"json-schema","title":"ocsfv1.4.0Attack","data":{"title":"ocsfv1.4.0Attack","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object describes the tactic, technique & sub-technique associated to an attack as defined in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"sub_technique":{"$ref":"#/components/schemas/ocsfv1.4.0SubTechnique","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Sub Technique object describes the sub technique ID and/or name associated to an attack, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"tactic":{"$ref":"#/components/schemas/ocsfv1.4.0Tactic","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Tactic object describes the tactic ID and/or name that is associated to an attack, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"tactics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Tactic"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Tactic object describes the tactic ID and/or tactic name that are associated with the attack technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"technique":{"$ref":"#/components/schemas/ocsfv1.4.0Technique","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Technique object describes the technique ID and/or name associated to an attack, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" version."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.4.0AuthFactor":{"id":"components/schemas/ocsfv1.4.0AuthFactor","kind":"json-schema","title":"ocsfv1.4.0AuthFactor","data":{"title":"ocsfv1.4.0AuthFactor","type":"object","description":"An Authentication Factor object describes a category of methods used for identity verification in an authentication attempt.","properties":{"device":{"$ref":"#/components/schemas/ocsfv1.4.0Device","nullable":true,"description":"Device used to complete an authentication request."},"email_addr":{"$ref":"#/components/schemas/ocsfv1.4.0EmailAddress","nullable":true,"description":"The email address used in an email-based authentication factor."},"factor_type":{"type":"string","nullable":true,"description":"The type of authentication factor used in an authentication attempt."},"factor_type_id":{"$ref":"#/components/schemas/ocsfv1.4.0AuthFactor_FactorTypeId","description":"The normalized identifier for the authentication factor."},"is_hotp":{"type":"boolean","nullable":true,"description":"Whether the authentication factor is an HMAC-based One-time Password (HOTP)."},"is_totp":{"type":"boolean","nullable":true,"description":"Whether the authentication factor is a Time-based One-time Password (TOTP)."},"phone_number":{"type":"string","nullable":true,"description":"The phone number used for a telephony-based authentication request."},"provider":{"type":"string","nullable":true,"description":"The name of provider for an authentication factor."},"security_questions":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The question(s) provided to user for a question-based authentication factor."}},"required":["factor_type_id"]}},"components/schemas/ocsfv1.4.0AuthFactor_FactorTypeId":{"id":"components/schemas/ocsfv1.4.0AuthFactor_FactorTypeId","kind":"json-schema","title":"ocsfv1.4.0AuthFactor_FactorTypeId","data":{"title":"ocsfv1.4.0AuthFactor_FactorTypeId","type":"integer","description":"AuthFactorFactorTypeId is an enum, and the following values are allowed.\n0 - Unknown\n1 - SMS: User receives and inputs a code sent to their mobile device via SMS text message.\n2 - SecurityQuestion: The user responds to a security question as part of a question-based authentication factor\n3 - PhoneCall: System calls the user's registered phone number and requires the user to answer and provide a response.\n4 - Biometric: Devices that verify identity-based on user's physical identifiers, such as fingerprint scanners or retina scanners.\n5 - PushNotification: Push notification is sent to user's registered device and requires the user to acknowledge.\n6 - HardwareToken: Physical device that generates a code to be used for authentication.\n7 - OTP: Application generates a one-time password (OTP) for use in authentication.\n8 - Email: A code or link is sent to a user's registered email address.\n9 - U2F: Typically involves a hardware token, which the user physically interacts with to authenticate.\n10 - WebAuthn: Web-based API that enables users to register devices as authentication factors.\n11 - Password: The user enters a password that they have previously established.\n99 - Other"}},"components/schemas/ocsfv1.4.0Authorization":{"id":"components/schemas/ocsfv1.4.0Authorization","kind":"json-schema","title":"ocsfv1.4.0Authorization","data":{"title":"ocsfv1.4.0Authorization","type":"object","description":"The Authorization Result object provides details about the authorization outcome and associated policies related to activity.","properties":{"decision":{"type":"string","nullable":true,"description":"Authorization Result/outcome, e.g. allowed, denied."},"policy":{"$ref":"#/components/schemas/ocsfv1.4.0Policy","nullable":true,"description":"Details about the Identity/Access management policies that are applicable."}}}},"components/schemas/ocsfv1.4.0AutonomousSystem":{"id":"components/schemas/ocsfv1.4.0AutonomousSystem","kind":"json-schema","title":"ocsfv1.4.0AutonomousSystem","data":{"title":"ocsfv1.4.0AutonomousSystem","type":"object","description":"An autonomous system (AS) is a collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators on behalf of a single administrative entity or domain that presents a common, clearly defined routing policy to the internet.","properties":{"name":{"type":"string","nullable":true,"description":"Organization name for the Autonomous System."},"number":{"type":"integer","nullable":true,"description":"Unique number that the AS is identified by."}}}},"components/schemas/ocsfv1.4.0Certificate":{"id":"components/schemas/ocsfv1.4.0Certificate","kind":"json-schema","title":"ocsfv1.4.0Certificate","data":{"title":"ocsfv1.4.0Certificate","type":"object","description":"The Digital Certificate, also known as a Public Key Certificate, object contains information about the ownership and usage of a public key. It serves as a means to establish trust in the authenticity and integrity of the public key and the associated entity.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the certificate was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the certificate was created."},"expiration_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The expiration time of the certificate."},"expiration_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The expiration time of the certificate."},"fingerprints":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Fingerprint"},"nullable":true,"description":"The fingerprint list of the certificate."},"is_self_signed":{"type":"boolean","nullable":true,"description":"Denotes whether a digital certificate is self-signed or signed by a known certificate authority (CA)."},"issuer":{"type":"string","description":"The certificate issuer distinguished name."},"sans":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0San"},"nullable":true,"description":"The list of subject alternative names that are secured by a specific certificate."},"serial_number":{"type":"string","description":"The serial number of the certificate used to create the digital signature."},"subject":{"type":"string","nullable":true,"description":"The certificate subject distinguished name."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the certificate."},"version":{"type":"string","nullable":true,"description":"The certificate version."}},"required":["issuer","serial_number"]}},"components/schemas/ocsfv1.4.0Cloud":{"id":"components/schemas/ocsfv1.4.0Cloud","kind":"json-schema","title":"ocsfv1.4.0Cloud","data":{"title":"ocsfv1.4.0Cloud","type":"object","description":"The Cloud object contains information about a cloud or Software-as-a-Service account or similar construct, such as AWS Account ID, regions, organizations, folders, compartments, tenants, etc.","properties":{"account":{"$ref":"#/components/schemas/ocsfv1.4.0Account","nullable":true,"description":"The account object describes details about the account that was the source or target of the activity."},"cloud_partition":{"type":"string","nullable":true,"description":"The canonical cloud partition name to which the region is assigned (e.g. AWS Partitions: aws, aws-cn, aws-us-gov)."},"org":{"$ref":"#/components/schemas/ocsfv1.4.0Organization","nullable":true,"description":"Organization and org unit relevant to the event or object."},"project_uid":{"type":"string","nullable":true,"description":"The unique identifier of a Cloud project."},"provider":{"type":"string","description":"The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc."},"region":{"type":"string","nullable":true,"description":"The name of the cloud region, as defined by the cloud provider."},"zone":{"type":"string","nullable":true,"description":"The availability zone in the cloud region, as defined by the cloud provider."}},"required":["provider"]}},"components/schemas/ocsfv1.4.0Container":{"id":"components/schemas/ocsfv1.4.0Container","kind":"json-schema","title":"ocsfv1.4.0Container","data":{"title":"ocsfv1.4.0Container","type":"object","description":"The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.","properties":{"hash":{"$ref":"#/components/schemas/ocsfv1.4.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Commit hash of image created for docker or the SHA256 hash of the container. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"image":{"$ref":"#/components/schemas/ocsfv1.4.0Image","nullable":true,"description":"The container image used as a template to run the container."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels associated to the container."},"name":{"type":"string","nullable":true,"description":"The container name."},"network_driver":{"type":"string","nullable":true,"description":"The network driver used by the container. For example, bridge, overlay, host, none, etc."},"orchestrator":{"type":"string","nullable":true,"description":"The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift."},"pod_uuid":{"type":"string","nullable":true,"description":"The unique identifier of the pod (or equivalent) that the container is executing on."},"runtime":{"type":"string","nullable":true,"description":"The backend running the container, such as containerd or cri-o."},"size":{"type":"integer","nullable":true,"description":"The size of the container image."},"tag":{"type":"string","nullable":true,"description":"The tag used by the container. It can indicate version, format, OS."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the container."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full container unique identifier for this instantiation of the container. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.4.0Cve":{"id":"components/schemas/ocsfv1.4.0Cve","kind":"json-schema","title":"ocsfv1.4.0Cve","data":{"title":"ocsfv1.4.0Cve","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Vulnerabilities and Exposures (CVE) object represents publicly disclosed cybersecurity vulnerabilities defined in CVE Program catalog ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cve.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVE"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"). There is one CVE Record for each vulnerability in the catalog."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE."},"cvss":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Cvss"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS object details Common Vulnerability Scoring System ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/cvss/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") scores from the advisory that are related to the vulnerability."},"children":[],"type":"text"}],"type":"paragraph"}]},"cwe":{"$ref":"#/components/schemas/ocsfv1.4.0Cwe","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CWE object represents a weakness in a software system that can be exploited by a threat actor to perform an attack. The CWE object is based on the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Common Weakness Enumeration (CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" catalog."},"children":[],"type":"text"}],"type":"paragraph"}]},"cwe_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Common Weakness Enumeration (CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" unique identifier. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CWE-787"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cwe_url":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Common Weakness Enumeration (CWE) definition URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://cwe.mitre.org/data/definitions/787.html"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"desc":{"type":"string","nullable":true,"description":"A brief description of the CVE Record."},"epss":{"$ref":"#/components/schemas/ocsfv1.4.0Epss","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Exploit Prediction Scoring System (EPSS) object describes the estimated probability a vulnerability will be exploited. EPSS is a community-driven effort to combine descriptive information about vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild. ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/epss/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"EPSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}]},"modified_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The Record Modified Date identifies when the CVE record was last updated."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The Record Modified Date identifies when the CVE record was last updated."},"product":{"$ref":"#/components/schemas/ocsfv1.4.0Product","nullable":true,"description":"The product where the vulnerability was discovered."},"references":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of reference URLs with additional information about the CVE Record."},"related_cwes":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Cwe"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the Common Weakness Enumeration "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"(CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" details related to the CVE Record."},"children":[],"type":"text"}],"type":"paragraph"}]},"title":{"type":"string","nullable":true,"description":"A title or a brief phrase summarizing the CVE record."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The vulnerability type as selected from a large dropdown menu during CVE refinement."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"Most frequently used vulnerability types are: "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"DoS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Code Execution"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Overflow"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Memory Corruption"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Sql Injection"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"XSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Directory Traversal"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Http Response Splitting"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Bypass something"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Gain Information"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Gain Privileges"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"CSRF"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"File Inclusion"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":". For more information see "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.cvedetails.com/vulnerabilities-by-types.php"}},"children":[{"$$mdtype":"Node","attributes":{"content":"Vulnerabilities By Type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" distributions."},"children":[],"type":"text"}]},"uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Vulnerabilities and Exposures unique number assigned to a specific computer vulnerability. A CVE Identifier begins with 4 digits representing the year followed by a sequence of digits that acts as a unique identifier. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVE-2021-12345"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["uid"]}},"components/schemas/ocsfv1.4.0Cvss":{"id":"components/schemas/ocsfv1.4.0Cvss","kind":"json-schema","title":"ocsfv1.4.0Cvss","data":{"title":"ocsfv1.4.0Cvss","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Vulnerability Scoring System ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/cvss/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") object provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"base_score":{"type":"number","format":"double","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS base score. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"9.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"depth":{"$ref":"#/components/schemas/ocsfv1.4.0Cvss_Depth","nullable":true,"description":"The CVSS depth represents a depth of the equation used to calculate CVSS score."},"metrics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Metric"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Vulnerability Scoring System metrics. This attribute contains information on the CVE's impact. If the CVE has been analyzed, this attribute will contain any CVSSv2 or CVSSv3 information associated with the vulnerability. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{ {\"Access Vector\", \"Network\"}, {\"Access Complexity\", \"Low\"}, ...}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"overall_score":{"type":"number","format":"double","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS overall score, impacted by base, temporal, and environmental metrics. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"9.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"CVSS v2.0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Low (0.0 – 3.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Medium (4.0 – 6.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"High (7.0 – 10.0)"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"CVSS v3.0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"None (0.0)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Low (0.1 - 3.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Medium (4.0 - 6.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"High (7.0 - 8.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Critical (9.0 - 10.0)"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The source URL for the CVSS score. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"vector_string":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"vendor_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The vendor that provided the CVSS score. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NVD, REDHAT"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" etc."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["base_score","version"]}},"components/schemas/ocsfv1.4.0Cvss_Depth":{"id":"components/schemas/ocsfv1.4.0Cvss_Depth","kind":"json-schema","title":"ocsfv1.4.0Cvss_Depth","data":{"title":"ocsfv1.4.0Cvss_Depth","type":"string","description":"CvssDepth is an enum, and the following values are allowed.\nBase - Base\nEnvironmental - Environmental\nTemporal - Temporal"}},"components/schemas/ocsfv1.4.0Cwe":{"id":"components/schemas/ocsfv1.4.0Cwe","kind":"json-schema","title":"ocsfv1.4.0Cwe","data":{"title":"ocsfv1.4.0Cwe","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CWE object represents a weakness in a software system that can be exploited by a threat actor to perform an attack. The CWE object is based on the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Common Weakness Enumeration (CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" catalog."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"caption":{"type":"string","nullable":true,"description":"The caption assigned to the Common Weakness Enumeration unique identifier."},"src_url":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"URL pointing to the CWE Specification. For more information see "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CWE."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Weakness Enumeration unique number assigned to a specific weakness. A CWE Identifier begins \"CWE\" followed by a sequence of digits that acts as a unique identifier. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CWE-123"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["uid"]}},"components/schemas/ocsfv1.4.0Database":{"id":"components/schemas/ocsfv1.4.0Database","kind":"json-schema","title":"ocsfv1.4.0Database","data":{"title":"ocsfv1.4.0Database","type":"object","description":"The database object is used for databases which are typically datastore services that contain an organized collection of structured and unstructured data or a types of data.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the database was known to have been created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the database was known to have been created."},"desc":{"type":"string","nullable":true,"description":"The description of the database."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Group"},"nullable":true,"description":"The group names to which the database belongs."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The most recent time when any changes, updates, or modifications were made within the database."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent time when any changes, updates, or modifications were made within the database."},"name":{"type":"string","nullable":true,"description":"The database name, ordinarily as assigned by a database administrator."},"size":{"type":"integer","nullable":true,"description":"The size of the database in bytes."},"type":{"type":"string","nullable":true,"description":"The database type."},"type_id":{"$ref":"#/components/schemas/ocsfv1.4.0Database_TypeId","description":"The normalized identifier of the database type."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the database."}},"required":["type_id"]}},"components/schemas/ocsfv1.4.0Database_TypeId":{"id":"components/schemas/ocsfv1.4.0Database_TypeId","kind":"json-schema","title":"ocsfv1.4.0Database_TypeId","data":{"title":"ocsfv1.4.0Database_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DatabaseTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Relational"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Network"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - ObjectOriented"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Centralized"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Operational"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - NoSQL"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Databucket":{"id":"components/schemas/ocsfv1.4.0Databucket","kind":"json-schema","title":"ocsfv1.4.0Databucket","data":{"title":"ocsfv1.4.0Databucket","type":"object","description":"The databucket object is a basic container that holds data, typically organized through the use of data partitions.","properties":{"agent_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Agent"},"nullable":true,"description":"A list of agent objects associated with a device, endpoint, or resource."},"cloud_partition":{"type":"string","nullable":true,"description":"The canonical cloud partition name to which the region is assigned (e.g. AWS Partitions: aws, aws-cn, aws-us-gov)."},"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the databucket was known to have been created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the databucket was known to have been created."},"criticality":{"type":"string","nullable":true,"description":"The criticality of the resource as defined by the event source."},"data":{"nullable":true,"description":"Additional data describing the resource."},"desc":{"type":"string","nullable":true,"description":"The description of the databucket."},"encryption_details":{"$ref":"#/components/schemas/ocsfv1.4.0EncryptionDetails","nullable":true,"description":"The encryption details of the databucket. Should be populated if the databucket is encrypted."},"file":{"$ref":"#/components/schemas/ocsfv1.4.0File","nullable":true,"description":"Details about the file/object within a databucket."},"group":{"$ref":"#/components/schemas/ocsfv1.4.0Group","nullable":true,"description":"The name of the related resource group."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Group"},"nullable":true,"description":"The group names to which the databucket belongs."},"hostname":{"$ref":"#/components/schemas/ocsfv1.4.0Hostname","nullable":true,"description":"The fully qualified name of the resource."},"ip":{"$ref":"#/components/schemas/ocsfv1.4.0IPAddress","nullable":true,"description":"The IP address associated with the resource."},"is_encrypted":{"type":"boolean","nullable":true,"description":"Indicates if the databucket is encrypted."},"is_public":{"type":"boolean","nullable":true,"description":"Indicates if the databucket is publicly accessible."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels/tags associated to a resource."},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The timestamp when the resource was last observed or reported."},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the resource was last observed or reported."},"mac":{"$ref":"#/components/schemas/ocsfv1.4.0MACAddress","nullable":true,"description":"The MAC address associated with the resource."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The most recent time when any changes, updates, or modifications were made within the databucket."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent time when any changes, updates, or modifications were made within the databucket."},"name":{"type":"string","nullable":true,"description":"The databucket name."},"namespace":{"type":"string","nullable":true,"description":"The namespace is useful when similar entities exist that you need to keep separate."},"os_type":{"type":"string","nullable":true,"description":"The type of operating system running on the resource."},"owner":{"$ref":"#/components/schemas/ocsfv1.4.0User","nullable":true,"description":"The identity of the service or user account that owns the resource."},"region":{"type":"string","nullable":true,"description":"The cloud region of the resource."},"size":{"type":"integer","nullable":true,"description":"The size of the databucket in bytes."},"src_url":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":"The URL of the resource in the event sources system."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":"The databucket type."},"type_id":{"$ref":"#/components/schemas/ocsfv1.4.0Databucket_TypeId","description":"The normalized identifier of the databucket type."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the databucket."},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor."},"vendor_uuid":{"type":"string","nullable":true,"description":"The UUID of the vendor."},"version":{"type":"string","nullable":true,"description":"The version of the resource. For example 1.2.3."}},"required":["type_id"]}},"components/schemas/ocsfv1.4.0Databucket_TypeId":{"id":"components/schemas/ocsfv1.4.0Databucket_TypeId","kind":"json-schema","title":"ocsfv1.4.0Databucket_TypeId","data":{"title":"ocsfv1.4.0Databucket_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DatabucketTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - S3"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - AzureBlob"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - GCPBucket"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Device":{"id":"components/schemas/ocsfv1.4.0Device","kind":"json-schema","title":"ocsfv1.4.0Device","data":{"title":"ocsfv1.4.0Device","type":"object","description":"The Device object represents an addressable computer system or host, which is typically connected to a computer network and participates in the transmission or processing of data within the computer network.","properties":{"agent_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Agent"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"agent"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects associated with a device, endpoint, or resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"autoscale_uid":{"type":"string","nullable":true,"description":"The unique identifier of the cloud autoscale configuration."},"boot_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time the system was booted."},"boot_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the system was booted."},"container":{"$ref":"#/components/schemas/ocsfv1.4.0Container","nullable":true,"description":"The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd."},"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the device was known to have been created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the device was known to have been created."},"desc":{"type":"string","nullable":true,"description":"The description of the device, ordinarily as reported by the operating system."},"domain":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network domain where the device resides. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"work.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"first_seen_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The initial discovery time of the device."},"first_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The initial discovery time of the device."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Group"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The group names to which the device belongs. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[\"Windows Laptops\", \"Engineering\"]"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"hostname":{"$ref":"#/components/schemas/ocsfv1.4.0Hostname","nullable":true,"description":"The device hostname."},"hw_info":{"$ref":"#/components/schemas/ocsfv1.4.0DeviceHwInfo","nullable":true,"description":"The endpoint hardware information."},"hypervisor":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the hypervisor running on the device. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Xen"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"VMware"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Hyper-V"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"VirtualBox"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", etc."},"children":[],"type":"text"}],"type":"paragraph"}]},"image":{"$ref":"#/components/schemas/ocsfv1.4.0Image","nullable":true,"description":"The image used as a template to run the virtual machine."},"imei":{"type":"string","nullable":true,"description":"The International Mobile Equipment Identity that is associated with the device."},"imei_list":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The International Mobile Equipment Identity values that are associated with the device."},"instance_uid":{"type":"string","nullable":true,"description":"The unique identifier of a VM instance."},"interface_name":{"type":"string","nullable":true,"description":"The name of the network interface (e.g. eth2)."},"interface_uid":{"type":"string","nullable":true,"description":"The unique identifier of the network interface."},"ip":{"$ref":"#/components/schemas/ocsfv1.4.0IPAddress","nullable":true,"description":"The device IP address, in either IPv4 or IPv6 format."},"ip_addresses":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of IP addresses available on the device"},"is_compliant":{"type":"boolean","nullable":true,"description":"The event occurred on a compliant device."},"is_managed":{"type":"boolean","nullable":true,"description":"The event occurred on a managed device."},"is_personal":{"type":"boolean","nullable":true,"description":"The event occurred on a personal device."},"is_trusted":{"type":"boolean","nullable":true,"description":"The event occurred on a trusted device."},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The most recent discovery time of the device."},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent discovery time of the device."},"location":{"$ref":"#/components/schemas/ocsfv1.4.0Location","nullable":true,"description":"The geographical location of the device."},"mac":{"$ref":"#/components/schemas/ocsfv1.4.0MACAddress","nullable":true,"description":"The Media Access Control (MAC) address of the endpoint."},"mac_addresses":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of MAC addresses available on the device"},"model":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The model of the device. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MacBook Pro"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"t3a.medium"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"modified_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the device was last known to have been modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the device was last known to have been modified."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The alternate device name, ordinarily as assigned by an administrator. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" could be any other string that helps to identify the device, such as a phone number; for example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"310-555-1234"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"namespace_pid":{"type":"integer","nullable":true,"description":"If running under a process namespace (such as in a container), the process identifier within that process namespace."},"netbios_names":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of NetBIOS names available on the device"},"network_interfaces":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0NetworkInterface"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network interfaces that are associated with the device, one for each unique MAC address/IP address/hostname/name combination."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" The first element of the array is the network information that pertains to the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"network_status":{"type":"string","nullable":true,"description":"The network isolation status of the endpoint"},"network_status_id":{"$ref":"#/components/schemas/ocsfv1.4.0Device_NetworkStatusId","nullable":true,"description":"The network isolation status ID."},"org":{"$ref":"#/components/schemas/ocsfv1.4.0Organization","nullable":true,"description":"Organization and org unit related to the device."},"os":{"$ref":"#/components/schemas/ocsfv1.4.0Os","nullable":true,"description":"The endpoint operating system."},"os_machine_uuid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The operating system assigned Machine ID. In Windows, this is the value stored at the registry path: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\MachineGuid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In Linux, this is stored in the file: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"/etc/machine-id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"owner":{"$ref":"#/components/schemas/ocsfv1.4.0User","nullable":true,"description":"The identity of the service or user account that owns the endpoint or was last logged into it."},"region":{"type":"string","nullable":true,"description":"The region where the virtual machine is located. For example, an AWS Region."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.4.0Device_RiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"src_url":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":"The URL of the device in the event sources system."},"subnet":{"$ref":"#/components/schemas/ocsfv1.4.0Subnet","nullable":true,"description":"The subnet mask."},"subnet_uid":{"type":"string","nullable":true,"description":"The unique identifier of a virtual subnet."},"sw_info":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Product"},"nullable":true,"description":"The list of software contained on a device"},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The device type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"unknown"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"plc"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"scada"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dcs"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cnc"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"scientific"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"medical"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"lighting"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"energy"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"transportation"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.4.0Device_TypeId","description":"The device type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the device. For example the Windows TargetSID or AWS EC2 ARN."},"uid_alt":{"type":"string","nullable":true,"description":"An alternate unique identifier of the device if any. For example the ActiveDirectory DN."},"vendor":{"$ref":"#/components/schemas/ocsfv1.4.0Organization","nullable":true,"description":"The product vendor that created the device."},"vendor_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The vendor for the device. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Dell"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Lenovo"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"vlan_uid":{"type":"string","nullable":true,"description":"The Virtual LAN identifier."},"vpc_uid":{"type":"string","nullable":true,"description":"The unique identifier of the Virtual Private Cloud (VPC)."},"zone":{"type":"string","nullable":true,"description":"The network zone or LAN segment."}},"required":["type_id"]}},"components/schemas/ocsfv1.4.0Device_NetworkStatusId":{"id":"components/schemas/ocsfv1.4.0Device_NetworkStatusId","kind":"json-schema","title":"ocsfv1.4.0Device_NetworkStatusId","data":{"title":"ocsfv1.4.0Device_NetworkStatusId","type":"integer","description":"DeviceNetworkStatusId is an enum, and the following values are allowed.\n1 - NotIsolated: Device is not isolated from the network.\n2 - Isolated: Device is isolated from the network.\n3 - PendingIsolation: Device is pending isolation from the network.\n4 - PendingRestore: Device is pending restoration from isolation.\n99 - Unknown: The network isolation status is unknown."}},"components/schemas/ocsfv1.4.0Device_RiskLevelId":{"id":"components/schemas/ocsfv1.4.0Device_RiskLevelId","kind":"json-schema","title":"ocsfv1.4.0Device_RiskLevelId","data":{"title":"ocsfv1.4.0Device_RiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DeviceRiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Device_TypeId":{"id":"components/schemas/ocsfv1.4.0Device_TypeId","kind":"json-schema","title":"ocsfv1.4.0Device_TypeId","data":{"title":"ocsfv1.4.0Device_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DeviceTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Server: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Server/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Desktop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Laptop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Tablet: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Mobile: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile phone"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Virtual: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual machine"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - IOT: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.techtarget.com/iotagenda/definition/IoT-device"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IOT (Internet of Things) device"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Browser: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Browser/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"web browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Firewall: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Firewall/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking firewall"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Switch: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Switch/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking switch"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Hub: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Ethernet_hub"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking hub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - Router: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Router/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking router"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - IDS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion detection system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - IPS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion prevention system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - LoadBalancer: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Load_balancing_(computing)"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Load Balancer device."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"89 - ImagingEquipment: Equipment for processing optical data, such as a camera."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"90 - PLC: A Programmable logic controller."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"91 - SCADA: A supervisory control and data acquisition system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"92 - DCS: A distributed control system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"93 - CNC: A computer numerical control system, including computerized machine tools."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"94 - ScientificEquipment: A piece of scientific equipment such as an oscilloscope or spectrometer."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"95 - MedicalDevice: A medical device such as an MRI machine or infusion pump."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"96 - LightingControls: A lighting control for internal or external applications."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"97 - EnergyMonitoringSystem: An energy monitoring, security or safety system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"98 - TransportationDevice: A transportation device or transportation supporting device."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0DeviceHwInfo":{"id":"components/schemas/ocsfv1.4.0DeviceHwInfo","kind":"json-schema","title":"ocsfv1.4.0DeviceHwInfo","data":{"title":"ocsfv1.4.0DeviceHwInfo","type":"object","description":"The Device Hardware Information object contains details and specifications of the physical components that make up a device. This information provides an overview of the hardware capabilities, configuration, and characteristics of the device.","properties":{"bios_date":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The BIOS date. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"03/31/16"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"bios_manufacturer":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The BIOS manufacturer. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LENOVO"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"bios_uid":{"type":"string","nullable":true,"description":"The BIOS UUID."},"bios_ver":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The BIOS version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LENOVO G5ETA2WW (2.62)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"chassis":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The chassis type describes the system enclosure or physical form factor. Such as the following examples for Windows "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Windows Chassis Types"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"cpu_architecture":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CPU architecture, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpu_architecture_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_architecture_id":{"$ref":"#/components/schemas/ocsfv1.4.0DeviceHwInfo_CpuArchitectureId","nullable":true,"description":"The normalized identifier of the CPU architecture."},"cpu_bits":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cpu architecture, the number of bits used for addressing in memory. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"32"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"64"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_cores":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of processor cores in all installed processors. For Example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"42"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of physical processors on a system. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_speed":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The speed of the processor in Mhz. For Example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"4200"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The processor type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"x86 Family 6 Model 37 Stepping 5"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"desktop_display":{"$ref":"#/components/schemas/ocsfv1.4.0Display","nullable":true,"description":"The desktop display affiliated with the event"},"keyboard_info":{"$ref":"#/components/schemas/ocsfv1.4.0KeyboardInfo","nullable":true,"description":"The keyboard detailed information."},"ram_size":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The total amount of installed RAM, in Megabytes. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2048"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"serial_number":{"type":"string","nullable":true,"description":"The device manufacturer serial number."},"uuid":{"type":"string","nullable":true,"description":"The device manufacturer assigned universally unique hardware identifier. For example: The BIOS System UUID or the Apple IOPlatformUUID."},"vendor_name":{"type":"string","nullable":true,"description":"The device manufacturer."}}}},"components/schemas/ocsfv1.4.0DeviceHwInfo_CpuArchitectureId":{"id":"components/schemas/ocsfv1.4.0DeviceHwInfo_CpuArchitectureId","kind":"json-schema","title":"ocsfv1.4.0DeviceHwInfo_CpuArchitectureId","data":{"title":"ocsfv1.4.0DeviceHwInfo_CpuArchitectureId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DeviceHwInfoCpuArchitectureId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The CPU architecture is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - x86: CPU uses the x86 ISA. For bitness, refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpu_bits"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - ARM: CPU uses the ARM ISA. For bitness, refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpu_bits"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - V: CPU uses the RISC-V ISA. For bitness, refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpu_bits"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The CPU architecture is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpu_architecture"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0DigitalSignature":{"id":"components/schemas/ocsfv1.4.0DigitalSignature","kind":"json-schema","title":"ocsfv1.4.0DigitalSignature","data":{"title":"ocsfv1.4.0DigitalSignature","type":"object","description":"The Digital Signature object contains information about the cryptographic mechanism used to verify the authenticity, integrity, and origin of the file or application.","properties":{"algorithm":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The digital signature algorithm used to create the signature, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"algorithm_id":{"$ref":"#/components/schemas/ocsfv1.4.0DigitalSignature_AlgorithmId","description":"The identifier of the normalized digital signature algorithm."},"certificate":{"$ref":"#/components/schemas/ocsfv1.4.0Certificate","nullable":true,"description":"The certificate object containing information about the digital certificate."},"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the digital signature was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the digital signature was created."},"developer_uid":{"type":"string","nullable":true,"description":"The developer ID on the certificate that signed the file."},"digest":{"$ref":"#/components/schemas/ocsfv1.4.0Fingerprint","nullable":true,"description":"The message digest attribute contains the fixed length message hash representation and the corresponding hashing algorithm information."},"state":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The digital signature state defines the signature state, normalized to the caption of 'state_id'. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"state_id":{"$ref":"#/components/schemas/ocsfv1.4.0DigitalSignature_StateId","nullable":true,"description":"The normalized identifier of the signature state."}},"required":["algorithm_id"]}},"components/schemas/ocsfv1.4.0DigitalSignature_AlgorithmId":{"id":"components/schemas/ocsfv1.4.0DigitalSignature_AlgorithmId","kind":"json-schema","title":"ocsfv1.4.0DigitalSignature_AlgorithmId","data":{"title":"ocsfv1.4.0DigitalSignature_AlgorithmId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DigitalSignatureAlgorithmId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The algorithm is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - DSA: Digital Signature Algorithm (DSA)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - ECDSA: Elliptic Curve Digital Signature Algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The algorithm is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"algorithm"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0DigitalSignature_StateId":{"id":"components/schemas/ocsfv1.4.0DigitalSignature_StateId","kind":"json-schema","title":"ocsfv1.4.0DigitalSignature_StateId","data":{"title":"ocsfv1.4.0DigitalSignature_StateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DigitalSignatureStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Valid: The digital signature is valid."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Expired: The digital signature is not valid due to expiration of certificate."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Revoked: The digital signature is invalid due to certificate revocation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Suspended: The digital signature is invalid due to certificate suspension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Pending: The digital signature state is pending."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Display":{"id":"components/schemas/ocsfv1.4.0Display","kind":"json-schema","title":"ocsfv1.4.0Display","data":{"title":"ocsfv1.4.0Display","type":"object","description":"The Display object contains information about the physical or virtual display connected to a computer system.","properties":{"color_depth":{"type":"integer","nullable":true,"description":"The numeric color depth."},"physical_height":{"type":"integer","nullable":true,"description":"The numeric physical height of display."},"physical_orientation":{"type":"integer","nullable":true,"description":"The numeric physical orientation of display."},"physical_width":{"type":"integer","nullable":true,"description":"The numeric physical width of display."},"scale_factor":{"type":"integer","nullable":true,"description":"The numeric scale factor of display."}}}},"components/schemas/ocsfv1.4.0DnsAnswer":{"id":"components/schemas/ocsfv1.4.0DnsAnswer","kind":"json-schema","title":"ocsfv1.4.0DnsAnswer","data":{"title":"ocsfv1.4.0DnsAnswer","type":"object","description":"The DNS Answer object represents a specific response provided by the Domain Name System (DNS) when querying for information about a domain or performing a DNS operation. It encapsulates the relevant details and data returned by the DNS server in response to a query.","properties":{"class":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The class of DNS data contained in this resource record. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.rfc-editor.org/rfc/rfc1035.txt"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC1035"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IN"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"flag_ids":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0DnsAnswer_FlagIds"},"nullable":true,"description":"The list of DNS answer header flag IDs."},"flags":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of DNS answer header flags."},"packet_uid":{"type":"integer","nullable":true,"description":"The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response."},"rdata":{"type":"string","description":"The data describing the DNS resource. The meaning of this data depends on the type and class of the resource record."},"ttl":{"type":"integer","nullable":true,"description":"The time interval that the resource record may be cached. Zero value means that the resource record can only be used for the transaction in progress, and should not be cached."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of data contained in this resource record. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.rfc-editor.org/rfc/rfc1035.txt"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC1035"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CNAME"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["rdata"]}},"components/schemas/ocsfv1.4.0DnsAnswer_FlagIds":{"id":"components/schemas/ocsfv1.4.0DnsAnswer_FlagIds","kind":"json-schema","title":"ocsfv1.4.0DnsAnswer_FlagIds","data":{"title":"ocsfv1.4.0DnsAnswer_FlagIds","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DnsAnswerFlagIds is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The flag is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - AuthoritativeAnswer"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - TruncatedResponse"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - RecursionDesired"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - RecursionAvailable"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - AuthenticData"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - CheckingDisabled"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The flag is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"flags"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0DomainContact":{"id":"components/schemas/ocsfv1.4.0DomainContact","kind":"json-schema","title":"ocsfv1.4.0DomainContact","data":{"title":"ocsfv1.4.0DomainContact","type":"object","description":"The contact information related to a domain registration, e.g., registrant, administrator, abuse, billing, or technical contact.","properties":{"email_addr":{"$ref":"#/components/schemas/ocsfv1.4.0EmailAddress","nullable":true,"description":"The user's primary email address."},"location":{"$ref":"#/components/schemas/ocsfv1.4.0Location","nullable":true,"description":"Location details for the contract such as the city, state/province, country, etc."},"name":{"type":"string","nullable":true,"description":"The individual or organization name for the contact."},"phone_number":{"type":"string","nullable":true,"description":"The number associated with the phone."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Domain Contact type, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source"},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.4.0DomainContact_TypeId","description":"The normalized domain contact type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the contact information, typically provided in WHOIS information."}},"required":["type_id"]}},"components/schemas/ocsfv1.4.0DomainContact_TypeId":{"id":"components/schemas/ocsfv1.4.0DomainContact_TypeId","kind":"json-schema","title":"ocsfv1.4.0DomainContact_TypeId","data":{"title":"ocsfv1.4.0DomainContact_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DomainContactTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Registrant: The contact information provided is for the domain registrant."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Administrative: The contact information provided is for the domain administrator."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Technical: The contact information provided is for the domain technical lead."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Billing: The contact information provided is for the domain billing lead."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Abuse: The contact information provided is for the domain abuse contact."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Email":{"id":"components/schemas/ocsfv1.4.0Email","kind":"json-schema","title":"ocsfv1.4.0Email","data":{"title":"ocsfv1.4.0Email","type":"object","description":"The Email object describes the email metadata such as sender, recipients, and direction, and can include embedded URLs and files.","properties":{"bcc":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The BCC recipients of the email. Similar to cc field but for BCC recipients."},"cc":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0EmailAddress"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable email header Cc values, as defined by RFC 5322. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cc_mailboxes":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-readable email header Cc Mailbox values. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"'Example User <example.user@usersdomain.com>'"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"delivered_to":{"$ref":"#/components/schemas/ocsfv1.4.0EmailAddress","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Delivered-To"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" email header field. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"delivered_to_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0EmailAddress"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Delivered-To"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" email header values. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"files":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0File"},"nullable":true,"description":"The files embedded or attached to the email."},"from":{"$ref":"#/components/schemas/ocsfv1.4.0EmailAddress","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable email header From values, as defined by RFC 5322. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"from_mailbox":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-readable email header From Mailbox value. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"'Example User <example.user@usersdomain.com>'"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"http_headers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0HttpHeader"},"nullable":true,"description":"Additional HTTP headers of an HTTP request or response."},"is_externally_viewable":{"type":"boolean","nullable":true,"description":"True if the email is viewable externally (presumably by external users)."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Labels associated with the object, such as security or sensitivity labels created by a scanning app."},"message_uid":{"type":"string","nullable":true,"description":"The email header Message-ID value, as defined by RFC 5322."},"raw_header":{"type":"string","nullable":true,"description":"The email authentication header."},"reply_to":{"$ref":"#/components/schemas/ocsfv1.4.0EmailAddress","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable email header Reply-To values, as defined by RFC 5322. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"reply_to_mailboxes":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-readable email header Reply To Mailbox values. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"'Example User <example.user@usersdomain.com>'"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"sender_mailbox_uid":{"type":"string","nullable":true,"description":"Unique ID of the sender mailbox. This is distinct from the sender's email address."},"size":{"type":"integer","nullable":true,"description":"The size in bytes of the email, including attachments."},"smtp_from":{"$ref":"#/components/schemas/ocsfv1.4.0EmailAddress","nullable":true,"description":"The value of the SMTP MAIL FROM command."},"smtp_to":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0EmailAddress"},"nullable":true,"description":"The value of the SMTP envelope RCPT TO command."},"subject":{"type":"string","nullable":true,"description":"The email header Subject value, as defined by RFC 5322."},"time_sent":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time at which the email was sent."},"time_sent_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time at which the email was sent."},"to":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0EmailAddress"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable email header To values, as defined by RFC 5322. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"to_mailboxes":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-readable email header To Mailbox values. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"'Example User <example.user@usersdomain.com>'"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the email thread."},"urls":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The URLs embedded in the email."},"x_originating_ip":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0IPAddress"},"nullable":true,"description":"The X-Originating-IP header identifying the emails originating IP address(es)."}}}},"components/schemas/ocsfv1.4.0EmailAuth":{"id":"components/schemas/ocsfv1.4.0EmailAuth","kind":"json-schema","title":"ocsfv1.4.0EmailAuth","data":{"title":"ocsfv1.4.0EmailAuth","type":"object","description":"The Email Authentication object describes the Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC) attributes of an email.","properties":{"dkim":{"type":"string","nullable":true,"description":"The DomainKeys Identified Mail (DKIM) status of the email."},"dkim_domain":{"type":"string","nullable":true,"description":"The DomainKeys Identified Mail (DKIM) signing domain of the email."},"dkim_signature":{"type":"string","nullable":true,"description":"The DomainKeys Identified Mail (DKIM) signature used by the sending/receiving system."},"dmarc":{"type":"string","nullable":true,"description":"The Domain-based Message Authentication, Reporting and Conformance (DMARC) status of the email."},"dmarc_override":{"type":"string","nullable":true,"description":"The Domain-based Message Authentication, Reporting and Conformance (DMARC) override action."},"dmarc_policy":{"type":"string","nullable":true,"description":"The Domain-based Message Authentication, Reporting and Conformance (DMARC) policy status."},"spf":{"type":"string","nullable":true,"description":"The Sender Policy Framework (SPF) status of the email."}}}},"components/schemas/ocsfv1.4.0EncryptionDetails":{"id":"components/schemas/ocsfv1.4.0EncryptionDetails","kind":"json-schema","title":"ocsfv1.4.0EncryptionDetails","data":{"title":"ocsfv1.4.0EncryptionDetails","type":"object","description":"Details about the encrytpion methodology utilized.","properties":{"algorithm":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The encryption algorithm used, normalized to the caption of 'algorithm_id"},"children":[],"type":"text"}],"type":"paragraph"}]},"algorithm_id":{"$ref":"#/components/schemas/ocsfv1.4.0EncryptionDetails_AlgorithmId","nullable":true,"description":"The encryption algorithm used."},"key_length":{"type":"integer","nullable":true,"description":"The length of the encryption key used."},"key_uid":{"type":"string","nullable":true,"description":"The unique identifier of the key used for encrpytion. For example, AWS KMS Key ARN."},"type":{"type":"string","nullable":true,"description":"The type of the encryption used."}}}},"components/schemas/ocsfv1.4.0EncryptionDetails_AlgorithmId":{"id":"components/schemas/ocsfv1.4.0EncryptionDetails_AlgorithmId","kind":"json-schema","title":"ocsfv1.4.0EncryptionDetails_AlgorithmId","data":{"title":"ocsfv1.4.0EncryptionDetails_AlgorithmId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"EncryptionDetailsAlgorithmId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The algorithm is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - DES: Data Encryption Standard Algorithm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - TripleDES: Triple Data Encryption Standard Algorithm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - AES: Advanced Encryption Standard Algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - RSA: Rivest-Shamir-Adleman Algorithm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - ECC: Elliptic Curve Cryptography Algorithm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - SM2: ShangMi Cryptographic Algorithm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The algorithm is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"algorithm"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Enrichment":{"id":"components/schemas/ocsfv1.4.0Enrichment","kind":"json-schema","title":"ocsfv1.4.0Enrichment","data":{"title":"ocsfv1.4.0Enrichment","type":"object","description":"The Enrichment object provides inline enrichment data for specific attributes of interest within an event. It serves as a mechanism to enhance or supplement the information associated with the event by adding additional relevant details or context.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the enrichment data was generated."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the enrichment data was generated."},"data":{"description":"The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record."},"desc":{"type":"string","nullable":true,"description":"A long description of the enrichment data."},"name":{"type":"string","description":"The name of the attribute to which the enriched data pertains."},"provider":{"type":"string","nullable":true,"description":"The enrichment data provider name."},"reputation":{"$ref":"#/components/schemas/ocsfv1.4.0Reputation","nullable":true,"description":"The reputation of the enrichment data."},"short_desc":{"type":"string","nullable":true,"description":"A short description of the enrichment data."},"src_url":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":"The URL of the source of the enrichment data."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The enrichment type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"location"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"value":{"type":"string","description":"The value of the attribute to which the enriched data pertains."}},"required":["data","name","value"]}},"components/schemas/ocsfv1.4.0EnvironmentVariable":{"id":"components/schemas/ocsfv1.4.0EnvironmentVariable","kind":"json-schema","title":"ocsfv1.4.0EnvironmentVariable","data":{"title":"ocsfv1.4.0EnvironmentVariable","type":"object","description":"An environment variable.","properties":{"name":{"type":"string","description":"The name of the environment variable."},"value":{"type":"string","description":"The value of the environment variable."}},"required":["name","value"]}},"components/schemas/ocsfv1.4.0Epss":{"id":"components/schemas/ocsfv1.4.0Epss","kind":"json-schema","title":"ocsfv1.4.0Epss","data":{"title":"ocsfv1.4.0Epss","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Exploit Prediction Scoring System (EPSS) object describes the estimated probability a vulnerability will be exploited. EPSS is a community-driven effort to combine descriptive information about vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild. ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/epss/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"EPSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The timestamp indicating when the EPSS score was calculated."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp indicating when the EPSS score was calculated."},"percentile":{"type":"number","format":"double","nullable":true,"description":"The EPSS score's percentile representing relative importance and ranking of the score in the larger EPSS dataset."},"score":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The EPSS score representing the probability [0-1] of exploitation in the wild in the next 30 days (following score publication)."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":"The version of the EPSS model used to calculate the score."}},"required":["score"]}},"components/schemas/ocsfv1.4.0Extension":{"id":"components/schemas/ocsfv1.4.0Extension","kind":"json-schema","title":"ocsfv1.4.0Extension","data":{"title":"ocsfv1.4.0Extension","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The OCSF Schema Extension object provides detailed information about the schema extension used to construct the event. The schema extensions are registered in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://github.com/ocsf/ocsf-schema/blob/main/extensions.md"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"extensions.md"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" file."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The schema extension name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dev"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The schema extension unique identifier. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"999"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The schema extension version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.0.0-alpha.2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["name","uid","version"]}},"components/schemas/ocsfv1.4.0Feature":{"id":"components/schemas/ocsfv1.4.0Feature","kind":"json-schema","title":"ocsfv1.4.0Feature","data":{"title":"ocsfv1.4.0Feature","type":"object","description":"The Feature object provides information about the software product feature that generated a specific event. It encompasses details related to the capabilities, components, user interface (UI) design, and performance upgrades associated with the feature.","properties":{"name":{"type":"string","nullable":true,"description":"The name of the feature."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the feature."},"version":{"type":"string","nullable":true,"description":"The version of the feature."}}}},"components/schemas/ocsfv1.4.0File":{"id":"components/schemas/ocsfv1.4.0File","kind":"json-schema","title":"ocsfv1.4.0File","data":{"title":"ocsfv1.4.0File","type":"object","description":"The File object represents the metadata associated with a file stored in a computer system. It encompasses information about the file itself, including its attributes, properties, and organizational details.","properties":{"accessed_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the file was last accessed."},"accessed_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the file was last accessed."},"accessor":{"$ref":"#/components/schemas/ocsfv1.4.0User","nullable":true,"description":"The name of the user who last accessed the object."},"accessor_app":{"$ref":"#/components/schemas/ocsfv1.4.0Product","nullable":true,"description":"The app which mediated access to the file. This could be separate from the source app, for example a case where a user exports a report from a web app. The source app would be their browser and the accessor app the web app."},"attributes":{"type":"integer","nullable":true,"description":"The bitmask value that represents the file attributes."},"company_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the company that published the file. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Microsoft Corporation"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidentiality":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidentiality_id":{"$ref":"#/components/schemas/ocsfv1.4.0File_ConfidentialityId","nullable":true,"description":"The normalized identifier of the file content confidentiality indicator."},"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the file was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the file was created."},"creator":{"$ref":"#/components/schemas/ocsfv1.4.0User","nullable":true,"description":"The user that created the file."},"desc":{"type":"string","nullable":true,"description":"The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type."},"drive_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The drive type, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"drive_type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"drive_type_id":{"$ref":"#/components/schemas/ocsfv1.4.0File_DriveTypeId","nullable":true,"description":"Identifies the type of a disk drive, i.e. fixed, removable, etc."},"encryption_details":{"$ref":"#/components/schemas/ocsfv1.4.0EncryptionDetails","nullable":true,"description":"The encryption details of the file. Should be populated if the file is encrypted."},"ext":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The extension of the file, excluding the leading dot. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"svchost.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"gz"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"export.tar.gz"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"hashes":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Fingerprint"},"nullable":true,"description":"An array of hash attributes."},"internal_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the file as identified within the file itself. This contrasts with the name by which the file is known on disk. Where available, the internal name is widely used by security practitioners and detection content because the on-disk file name is not reliable. On the Windows OS, most PE files contain a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"href":"https://learn.microsoft.com/en-us/windows/win32/menurc/versioninfo-resource"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"VERSIONINFO"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" resource from which the internal name can be obtained. On macOS, binaries can optionally embed a copy of the application's Info.plist file which in turn contains the name of the executable."},"children":[],"type":"text"}],"type":"paragraph"}]},"is_deleted":{"type":"boolean","nullable":true,"description":"Indicates if the file was deleted from the filesystem."},"is_encrypted":{"type":"boolean","nullable":true,"description":"Indicates if the file is encrypted."},"is_public":{"type":"boolean","nullable":true,"description":"Indicates if the file is publicly accessible. For example in an object's public access in AWS S3"},"is_system":{"type":"boolean","nullable":true,"description":"The indication of whether the object is part of the operating system."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Labels associated with the object, such as security or sensitivity labels created by a scanning app."},"mime_type":{"type":"string","nullable":true,"description":"The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the file was last modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the file was last modified."},"modifier":{"$ref":"#/components/schemas/ocsfv1.4.0User","nullable":true,"description":"The user that last modified the file."},"name":{"$ref":"#/components/schemas/ocsfv1.4.0FileName","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the file. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"svchost.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"owner":{"$ref":"#/components/schemas/ocsfv1.4.0User","nullable":true,"description":"The user that owns the file/object."},"parent_folder":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The parent folder in which the file resides. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"c:\\windows\\system32"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"path":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full path to the file. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"c:\\windows\\system32\\svchost.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"product":{"$ref":"#/components/schemas/ocsfv1.4.0Product","nullable":true,"description":"The product that created or installed the file."},"security_descriptor":{"type":"string","nullable":true,"description":"The object security descriptor."},"signature":{"$ref":"#/components/schemas/ocsfv1.4.0DigitalSignature","nullable":true,"description":"The digital signature of the file."},"size":{"type":"integer","nullable":true,"description":"The size of data, in bytes."},"storage_class":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The storage class of the file. For example in AWS S3: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"STANDARD, STANDARD_IA, GLACIER"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the file."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":"The file type."},"type_id":{"$ref":"#/components/schemas/ocsfv1.4.0File_TypeId","description":"The file type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the file as defined by the storage system, such the file system file ID."},"url":{"$ref":"#/components/schemas/ocsfv1.4.0Url","nullable":true,"description":"The URL of the file, when applicable."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The file version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"8.0.7601.17514"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"xattributes":{"$ref":"#/components/schemas/ocsfv1.4.0Object","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An unordered collection of zero or more name/value pairs where each pair represents a file or folder extended attribute."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example: Windows alternate data stream attributes (ADS stream name, ADS size, etc.), user-defined or application-defined attributes, ACL, owner, primary group, etc. Examples from DCS: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ads_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ads_size"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dacl"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"owner"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"primary_group"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"link_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" - name of the link associated to the file."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"hard_link_count"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" - the number of links that are associated to the file."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"required":["name","type_id"]}},"components/schemas/ocsfv1.4.0File_ConfidentialityId":{"id":"components/schemas/ocsfv1.4.0File_ConfidentialityId","kind":"json-schema","title":"ocsfv1.4.0File_ConfidentialityId","data":{"title":"ocsfv1.4.0File_ConfidentialityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FileConfidentialityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The confidentiality is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - NotConfidential"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Confidential"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Secret"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - TopSecret"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Private"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Restricted"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidentiality is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidentiality"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0File_DriveTypeId":{"id":"components/schemas/ocsfv1.4.0File_DriveTypeId","kind":"json-schema","title":"ocsfv1.4.0File_DriveTypeId","data":{"title":"ocsfv1.4.0File_DriveTypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FileDriveTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The drive type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Removable: The drive has removable media; for example, a floppy drive, thumb drive, or flash card reader."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Fixed: The drive has fixed media; for example, a hard disk drive or flash drive."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Remote: The drive is a remote (network) drive."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - ROM: The drive is a CD-ROM drive."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - RAMDisk: The drive is a RAM disk."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The drive type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"drive_type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0File_TypeId":{"id":"components/schemas/ocsfv1.4.0File_TypeId","kind":"json-schema","title":"ocsfv1.4.0File_TypeId","data":{"title":"ocsfv1.4.0File_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FileTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - RegularFile"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Folder"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - CharacterDevice"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - BlockDevice"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - LocalSocket"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - NamedPipe"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - SymbolicLink"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Fingerprint":{"id":"components/schemas/ocsfv1.4.0Fingerprint","kind":"json-schema","title":"ocsfv1.4.0Fingerprint","data":{"title":"ocsfv1.4.0Fingerprint","type":"object","description":"The Fingerprint object provides detailed information about a digital fingerprint, which is a compact representation of data used to identify a longer piece of information, such as a public key or file content. It contains the algorithm and value of the fingerprint, enabling efficient and reliable identification of the associated data.","properties":{"algorithm":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash algorithm used to create the digital fingerprint, normalized to the caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"algorithm_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"algorithm_id":{"$ref":"#/components/schemas/ocsfv1.4.0Fingerprint_AlgorithmId","description":"The identifier of the normalized hash algorithm, which was used to create the digital fingerprint."},"value":{"$ref":"#/components/schemas/ocsfv1.4.0Hash","description":"The digital fingerprint value."}},"required":["algorithm_id","value"]}},"components/schemas/ocsfv1.4.0Fingerprint_AlgorithmId":{"id":"components/schemas/ocsfv1.4.0Fingerprint_AlgorithmId","kind":"json-schema","title":"ocsfv1.4.0Fingerprint_AlgorithmId","data":{"title":"ocsfv1.4.0Fingerprint_AlgorithmId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FingerprintAlgorithmId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The algorithm is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context Triggered Piecewise Hash (CTPH)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - TLSH: The TLSH fuzzy hashing algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that works by XORing the bytes in a circular-shifting fashion."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The algorithm is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"algorithm"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0FirewallRule":{"id":"components/schemas/ocsfv1.4.0FirewallRule","kind":"json-schema","title":"ocsfv1.4.0FirewallRule","data":{"title":"ocsfv1.4.0FirewallRule","type":"object","description":"The Firewall Rule object represents a specific rule within a firewall policy or event. It contains information about a rule's configuration, properties, and associated actions that define how network traffic is handled by the firewall.","properties":{"category":{"type":"string","nullable":true,"description":"The rule category."},"condition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The rule trigger condition for the rule. For example: SQL_INJECTION."},"children":[],"type":"text"}],"type":"paragraph"}]},"desc":{"type":"string","nullable":true,"description":"The description of the rule that generated the event."},"duration":{"type":"integer","nullable":true,"description":"The rule response time duration, usually used for challenge completion time."},"match_details":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The data in a request that rule matched. For example: '[\"10\",\"and\",\"1\"]'."},"children":[],"type":"text"}],"type":"paragraph"}]},"match_location":{"type":"string","nullable":true,"description":"The location of the matched data in the source which resulted in the triggered firewall rule. For example: HEADER."},"name":{"type":"string","nullable":true,"description":"The name of the rule that generated the event."},"rate_limit":{"type":"integer","nullable":true,"description":"The rate limit for a rate-based rule."},"sensitivity":{"type":"string","nullable":true,"description":"The sensitivity of the firewall rule in the matched event. For example: HIGH."},"type":{"type":"string","nullable":true,"description":"The rule type."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the rule that generated the event."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The rule version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.4.0Group":{"id":"components/schemas/ocsfv1.4.0Group","kind":"json-schema","title":"ocsfv1.4.0Group","data":{"title":"ocsfv1.4.0Group","type":"object","description":"The Group object represents a collection or association of entities, such as users, policies, or devices. It serves as a logical grouping mechanism to organize and manage entities with similar characteristics or permissions within a system or organization, including but not limited to purposes of access control.","properties":{"desc":{"type":"string","nullable":true,"description":"The group description."},"domain":{"type":"string","nullable":true,"description":"The domain where the group is defined. For example: the LDAP or Active Directory domain."},"email_addr":{"$ref":"#/components/schemas/ocsfv1.4.0EmailAddress","nullable":true,"description":"The group's email address. For example, a Google Group email address."},"name":{"type":"string","nullable":true,"description":"The group name."},"privileges":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The group privileges."},"type":{"type":"string","nullable":true,"description":"The type of the group or account."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group."}}}},"components/schemas/ocsfv1.4.0HttpHeader":{"id":"components/schemas/ocsfv1.4.0HttpHeader","kind":"json-schema","title":"ocsfv1.4.0HttpHeader","data":{"title":"ocsfv1.4.0HttpHeader","type":"object","description":"The HTTP Header object represents the headers sent in an HTTP request or response. HTTP headers are key-value pairs that convey additional information about the HTTP message, including details about the content, caching, authentication, encoding, and other aspects of the communication.","properties":{"name":{"type":"string","description":"The name of the HTTP header."},"value":{"type":"string","description":"The value of the HTTP header."}},"required":["name","value"]}},"components/schemas/ocsfv1.4.0Idp":{"id":"components/schemas/ocsfv1.4.0Idp","kind":"json-schema","title":"ocsfv1.4.0Idp","data":{"title":"ocsfv1.4.0Idp","type":"object","description":"The Identity Provider object contains detailed information about a provider responsible for creating, maintaining, and managing identity information while offering authentication services to applications. An Identity Provider (IdP) serves as a trusted authority that verifies the identity of users and issues authentication tokens or assertions to enable secure access to applications or services.","properties":{"auth_factors":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0AuthFactor"},"nullable":true,"description":"The Authentication Factors object describes the different types of Multi-Factor Authentication (MFA) methods and/or devices supported by the Identity Provider."},"domain":{"type":"string","nullable":true,"description":"The primary domain associated with the Identity Provider."},"fingerprint":{"$ref":"#/components/schemas/ocsfv1.4.0Fingerprint","nullable":true,"description":"The fingerprint of the X.509 certificate used by the Identity Provider."},"has_mfa":{"type":"boolean","nullable":true,"description":"The Identity Provider enforces Multi Factor Authentication (MFA)."},"issuer":{"type":"string","nullable":true,"description":"The unique identifier (often a URL) used by the Identity Provider as its issuer."},"name":{"type":"string","nullable":true,"description":"The name of the Identity Provider."},"protocol_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The supported protocol of the Identity Provider. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SAML"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OIDC"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OAuth2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"scim":{"$ref":"#/components/schemas/ocsfv1.4.0Scim","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The System for Cross-domain Identity Management (SCIM) resource object provides a structured set of attributes related to SCIM protocols used for identity provisioning and management across cloud-based platforms. It standardizes user and group provisioning details, enabling identity synchronization and lifecycle management with compatible Identity Providers (IdPs) and applications. SCIM is defined in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc7643"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-7634"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"sso":{"$ref":"#/components/schemas/ocsfv1.4.0Sso","nullable":true,"description":"The Single Sign-On (SSO) object provides a structure for normalizing SSO attributes, configuration, and/or settings from Identity Providers."},"state":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The configuration state of the Identity Provider, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"state_id":{"$ref":"#/components/schemas/ocsfv1.4.0Idp_StateId","nullable":true,"description":"The normalized state ID of the Identity Provider to reflect its configuration or activation status."},"tenant_uid":{"type":"string","nullable":true,"description":"The tenant ID associated with the Identity Provider."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the Identity Provider."},"url_string":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":"The URL for accessing the configuration or metadata of the Identity Provider."}}}},"components/schemas/ocsfv1.4.0Idp_StateId":{"id":"components/schemas/ocsfv1.4.0Idp_StateId","kind":"json-schema","title":"ocsfv1.4.0Idp_StateId","data":{"title":"ocsfv1.4.0Idp_StateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IdpStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The configuration state of the Identity Provider is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Active: The Identity Provider is in an Active state, or otherwise enabled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Suspended: The Identity Provider is in a Suspended state."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Deprecated: The Identity Provider is in a Deprecated state, or is otherwise disabled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Deleted: The Identity Provider is in a Deleted state."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The configuration state of the Identity Provider is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Image":{"id":"components/schemas/ocsfv1.4.0Image","kind":"json-schema","title":"ocsfv1.4.0Image","data":{"title":"ocsfv1.4.0Image","type":"object","description":"The Image object provides a description of a specific Virtual Machine (VM) or Container image.","properties":{"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels associated to the image."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The image name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"elixir"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"path":{"type":"string","nullable":true,"description":"The full path to the image file."},"tag":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The image tag. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.11-alpine"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the image."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique image ID. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"77af4d6b9913"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["uid"]}},"components/schemas/ocsfv1.4.0KbArticle":{"id":"components/schemas/ocsfv1.4.0KbArticle","kind":"json-schema","title":"ocsfv1.4.0KbArticle","data":{"title":"ocsfv1.4.0KbArticle","type":"object","description":"The KB Article object contains metadata that describes the patch or update.","properties":{"avg_timespan":{"$ref":"#/components/schemas/ocsfv1.4.0Timespan","nullable":true,"description":"The average time to patch."},"bulletin":{"type":"string","nullable":true,"description":"The kb article bulletin identifier."},"classification":{"type":"string","nullable":true,"description":"The vendors classification of the kb article."},"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The date the kb article was released by the vendor."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The date the kb article was released by the vendor."},"install_state":{"type":"string","nullable":true,"description":"The install state of the kb article."},"install_state_id":{"$ref":"#/components/schemas/ocsfv1.4.0KbArticle_InstallStateId","nullable":true,"description":"The normalized install state ID of the kb article."},"is_superseded":{"type":"boolean","nullable":true,"description":"The kb article has been replaced by another."},"os":{"$ref":"#/components/schemas/ocsfv1.4.0Os","nullable":true,"description":"The operating system the kb article applies."},"product":{"$ref":"#/components/schemas/ocsfv1.4.0Product","nullable":true,"description":"The product details the kb article applies."},"severity":{"type":"string","nullable":true,"description":"The severity of the kb article."},"size":{"type":"integer","nullable":true,"description":"The size in bytes for the kb article."},"src_url":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":"The kb article link from the source vendor."},"title":{"type":"string","nullable":true,"description":"The title of the kb article."},"uid":{"type":"string","description":"The unique identifier for the kb article."}},"required":["uid"]}},"components/schemas/ocsfv1.4.0KbArticle_InstallStateId":{"id":"components/schemas/ocsfv1.4.0KbArticle_InstallStateId","kind":"json-schema","title":"ocsfv1.4.0KbArticle_InstallStateId","data":{"title":"ocsfv1.4.0KbArticle_InstallStateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"KbArticleInstallStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized install state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Installed: The item is installed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - NotInstalled: The item is not installed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - InstalledPendingReboot: The item is installed pending reboot operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The install state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"install_state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0KeyValueObject":{"id":"components/schemas/ocsfv1.4.0KeyValueObject","kind":"json-schema","title":"ocsfv1.4.0KeyValueObject","data":{"title":"ocsfv1.4.0KeyValueObject","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A generic object allowing to define a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pair."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","description":"The name of the key."},"value":{"type":"string","nullable":true,"description":"The value associated to the key."},"values":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Optional, the values associated to the key. You can populate this attribute, when you have multiple values for the same key."}},"required":["name"]}},"components/schemas/ocsfv1.4.0KeyboardInfo":{"id":"components/schemas/ocsfv1.4.0KeyboardInfo","kind":"json-schema","title":"ocsfv1.4.0KeyboardInfo","data":{"title":"ocsfv1.4.0KeyboardInfo","type":"object","description":"The Keyboard Information object contains details and attributes related to a computer or device keyboard. It encompasses information that describes the characteristics, capabilities, and configuration of the keyboard.","properties":{"function_keys":{"type":"integer","nullable":true,"description":"The number of function keys on client keyboard."},"ime":{"type":"string","nullable":true,"description":"The Input Method Editor (IME) file name."},"keyboard_layout":{"type":"string","nullable":true,"description":"The keyboard locale identifier name (e.g., en-US)."},"keyboard_subtype":{"type":"integer","nullable":true,"description":"The keyboard numeric code."},"keyboard_type":{"type":"string","nullable":true,"description":"The keyboard type (e.g., xt, ico)."}}}},"components/schemas/ocsfv1.4.0KillChainPhase":{"id":"components/schemas/ocsfv1.4.0KillChainPhase","kind":"json-schema","title":"ocsfv1.4.0KillChainPhase","data":{"title":"ocsfv1.4.0KillChainPhase","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Kill Chain Phase object represents a single phase of a cyber attack, including the initial reconnaissance and planning stages up to the final objective of the attacker. It provides a detailed description of each phase and its associated activities within the broader context of a cyber attack. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Cyber Kill Chain®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"phase":{"type":"string","nullable":true,"description":"The cyber kill chain phase."},"phase_id":{"$ref":"#/components/schemas/ocsfv1.4.0KillChainPhase_PhaseId","description":"The cyber kill chain phase identifier."}},"required":["phase_id"]}},"components/schemas/ocsfv1.4.0KillChainPhase_PhaseId":{"id":"components/schemas/ocsfv1.4.0KillChainPhase_PhaseId","kind":"json-schema","title":"ocsfv1.4.0KillChainPhase_PhaseId","data":{"title":"ocsfv1.4.0KillChainPhase_PhaseId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"KillChainPhasePhaseId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The kill chain phase is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Reconnaissance: The attackers pick a target and perform a detailed analysis, start collecting information (email addresses, conferences information, etc.) and evaluate the victim’s vulnerabilities to determine how to exploit them."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Weaponization: The attackers develop a malware weapon and aim to exploit the discovered vulnerabilities."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Delivery: The intruders will use various tactics, such as phishing, infected USB drives, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Exploitation: The intruders start leveraging vulnerabilities to executed code on the victim’s system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Installation: The intruders install malware on the victim’s system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Control: Malware opens a command channel to enable the intruders to remotely manipulate the victim's system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - ActionsonObjectives: With hands-on keyboard access, intruders accomplish the mission’s goal."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The kill chain phase is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"phase"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0LdapPerson":{"id":"components/schemas/ocsfv1.4.0LdapPerson","kind":"json-schema","title":"ocsfv1.4.0LdapPerson","data":{"title":"ocsfv1.4.0LdapPerson","type":"object","description":"The additional LDAP attributes that describe a person.","properties":{"cost_center":{"type":"string","nullable":true,"description":"The cost center associated with the user."},"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The timestamp when the user was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user was created."},"deleted_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The timestamp when the user was deleted. In Active Directory (AD), when a user is deleted they are moved to a temporary container and then removed after 30 days. So, this field can be populated even after a user is deleted for the next 30 days."},"deleted_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user was deleted. In Active Directory (AD), when a user is deleted they are moved to a temporary container and then removed after 30 days. So, this field can be populated even after a user is deleted for the next 30 days."},"eligible_for_rehire":{"type":"boolean","nullable":true,"description":"Indicates whether the user is eligible for rehire. This typically applies to terminated or retired employees."},"email_addrs":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0EmailAddress"},"nullable":true,"description":"A list of additional email addresses for the user."},"employee_uid":{"type":"string","nullable":true,"description":"The employee identifier assigned to the user by the organization."},"employment_status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The employment status, normalized to the caption of the employment_status_id value. In the case of 'Other', it is defined by the data source."},"children":[],"type":"text"}],"type":"paragraph"}]},"employment_status_date":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The timestamp when the employment status was last changed."},"employment_status_date_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the employment status was last changed."},"employment_status_id":{"$ref":"#/components/schemas/ocsfv1.4.0LdapPerson_EmploymentStatusId","nullable":true,"description":"The normalized identifier of the user's employment status."},"given_name":{"type":"string","nullable":true,"description":"The given or first name of the user."},"hire_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The timestamp when the user was or will be hired by the organization."},"hire_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user was or will be hired by the organization."},"job_title":{"type":"string","nullable":true,"description":"The user's job title."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The labels associated with the user. For example in AD this could be the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"userType"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"employeeType"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Member, Employee"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"last_login_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The last time when the user logged in."},"last_login_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The last time when the user logged in."},"ldap_cn":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The LDAP and X.500 "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"commonName"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, typically the full name of the person. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"John Doe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"ldap_dn":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The X.500 Distinguished Name (DN) is a structured string that uniquely identifies an entry, such as a user, in an X.500 directory service For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cn=John Doe,ou=People,dc=example,dc=com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"leave_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The timestamp when the user left or will be leaving the organization."},"leave_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user left or will be leaving the organization."},"location":{"$ref":"#/components/schemas/ocsfv1.4.0Location","nullable":true,"description":"The geographical location associated with a user. This is typically the user's usual work location."},"manager":{"$ref":"#/components/schemas/ocsfv1.4.0Object","nullable":true,"description":"The user's manager. This helps in understanding an org hierarchy. This should only ever be populated once in an event. I.e. there should not be a manager's manager in an event."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The timestamp when the user entry was last modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user entry was last modified."},"office_location":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The primary office location associated with the user. This could be any string and isn't a specific address. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"South East Virtual"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"phone_number":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The telephone number of the user. Corresponds to the LDAP "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Telephone-Number"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" CN."},"children":[],"type":"text"}],"type":"paragraph"}]},"position_start_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The date the user first started work in their current position. For employees who have not changed positions, this equals the hire date. For employees who have transferred or been promoted, this reflects when they entered their current role."},"position_start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The date the user first started work in their current position. For employees who have not changed positions, this equals the hire date. For employees who have transferred or been promoted, this reflects when they entered their current role."},"regrettable_termination":{"type":"boolean","nullable":true,"description":"Indicates whether a termination is considered regrettable by the organization (i.e., loss of a valued employee). This is typically only populated for terminated employees."},"reports":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Object"},"nullable":true,"description":"The user's direct reports. This is the inverse of the manager relationship, representing users who report directly to this user in the organizational hierarchy. This field only includes immediate/direct reports, not transitive reports."},"surname":{"type":"string","nullable":true,"description":"The last or family name for the user."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the user."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.4.0LdapPerson_EmploymentStatusId":{"id":"components/schemas/ocsfv1.4.0LdapPerson_EmploymentStatusId","kind":"json-schema","title":"ocsfv1.4.0LdapPerson_EmploymentStatusId","data":{"title":"ocsfv1.4.0LdapPerson_EmploymentStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LdapPersonEmploymentStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The employment status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Applicant: The user is a job applicant or candidate who has not yet been hired."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Active: The user is currently employed and actively working."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Terminated: The user's employment has been terminated."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Retired: The user has retired from the organization."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The employment status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"employment_status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0LeaveEvent":{"id":"components/schemas/ocsfv1.4.0LeaveEvent","kind":"json-schema","title":"ocsfv1.4.0LeaveEvent","data":{"title":"ocsfv1.4.0LeaveEvent","type":"object","description":"A leave of absence event for a person. May represent a current, past, or future leave.","properties":{"desc":{"type":"string","nullable":true,"description":"The description that pertains to the object or event. See specific usage."},"leave_end_date":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The date on which the leave of absence ends."},"leave_end_date_dt":{"type":"string","format":"date-time","nullable":true,"description":"The date on which the leave of absence ends."},"leave_start_date":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The date on which the leave of absence begins."},"leave_start_date_dt":{"type":"string","format":"date-time","nullable":true,"description":"The date on which the leave of absence begins."}}}},"components/schemas/ocsfv1.4.0Location":{"id":"components/schemas/ocsfv1.4.0Location","kind":"json-schema","title":"ocsfv1.4.0Location","data":{"title":"ocsfv1.4.0Location","type":"object","description":"The Geo Location object describes a geographical location, usually associated with an IP address.","properties":{"aerial_height":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Expressed as either height above takeoff location or height above ground level (AGL) for a UAS current location. This value is provided in meters and must have a minimum resolution of 1 m. Special Values: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Invalid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"No Value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Unknown: -1000 m"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"city":{"type":"string","nullable":true,"description":"The name of the city."},"continent":{"type":"string","nullable":true,"description":"The name of the continent."},"coordinates":{"type":"array","items":{"type":"number","format":"double"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A two-element array, containing a longitude/latitude pair. The format conforms with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://geojson.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"GeoJSON"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[-73.983, 40.719]"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"country":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The ISO 3166-1 Alpha-2 country code."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" The two letter country code should be capitalized. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"US"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CA"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"desc":{"type":"string","nullable":true,"description":"The description of the geographical location."},"geodetic_altitude":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The aircraft distance above or below the ellipsoid as measured along a line that passes through the aircraft and is normal to the surface of the WGS-84 ellipsoid. This value is provided in meters and must have a minimum resolution of 1 m. Special Values: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Invalid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"No Value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Unknown: -1000 m"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"geodetic_vertical_accuracy":{"type":"string","nullable":true,"description":"Provides quality/containment on geodetic altitude. This is based on ADS-B Geodetic Vertical Accuracy (GVA). Measured in meters."},"geohash":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Geohash of the geo-coordinates (latitude and longitude)."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Geohash"}},"children":[{"$$mdtype":"Node","attributes":{"content":"Geohashing"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" is a geocoding system used to encode geographic coordinates in decimal degrees, to a single string."},"children":[],"type":"text"}]},"horizontal_accuracy":{"type":"string","nullable":true,"description":"Provides quality/containment on horizontal position. This is based on ADS-B NACp. Measured in meters."},"is_on_premises":{"type":"boolean","nullable":true,"description":"The indication of whether the location is on premises."},"isp":{"type":"string","nullable":true,"description":"The name of the Internet Service Provider (ISP)."},"lat":{"type":"number","format":"double","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The geographical Latitude coordinate represented in Decimal Degrees (DD). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"42.361145"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"long":{"type":"number","format":"double","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The geographical Longitude coordinate represented in Decimal Degrees (DD). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"-71.057083"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"postal_code":{"type":"string","nullable":true,"description":"The postal code of the location."},"pressure_altitude":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The uncorrected barometric pressure altitude (based on reference standard 29.92 inHg, 1013.25 mb) provides a reference for algorithms that utilize 'altitude deltas' between aircraft. This value is provided in meters and must have a minimum resolution of 1 m.. Special Values: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Invalid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"No Value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Unknown: -1000 m"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"provider":{"type":"string","nullable":true,"description":"The provider of the geographical location data."},"region":{"type":"string","nullable":true,"description":"The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. For example, 'CH-VD' for the Canton of Vaud, Switzerland"},"timezone":{"type":"string","nullable":true,"description":"Timezone string. This provides timezone information that may be present even when latitude and longitude are absent."}}}},"components/schemas/ocsfv1.4.0Logger":{"id":"components/schemas/ocsfv1.4.0Logger","kind":"json-schema","title":"ocsfv1.4.0Logger","data":{"title":"ocsfv1.4.0Logger","type":"object","description":"The Logger object represents the device and product where events are stored with times for receipt and transmission.  This may be at the source device where the event occurred, a remote scanning device, intermediate hops, or the ultimate destination.","properties":{"device":{"$ref":"#/components/schemas/ocsfv1.4.0Device","nullable":true,"description":"The device where the events are logged."},"event_uid":{"type":"string","nullable":true,"description":"The unique identifier of the event assigned by the logger."},"log_level":{"type":"string","nullable":true,"description":"The audit level at which an event was generated."},"log_name":{"type":"string","nullable":true,"description":"The event log name. For example, syslog file name or Windows logging subsystem: Security."},"log_provider":{"type":"string","nullable":true,"description":"The logging provider or logging service that logged the event. For example, Microsoft-Windows-Security-Auditing."},"log_version":{"type":"string","nullable":true,"description":"The event log schema version that specifies the format of the original event. For example syslog version or Cisco Log Schema Version."},"logged_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The time when the logging system collected and logged the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different."},"children":[],"type":"text"}]},"logged_time_dt":{"type":"string","format":"date-time","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The time when the logging system collected and logged the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different."},"children":[],"type":"text"}]},"name":{"type":"string","nullable":true,"description":"The name of the logging product instance."},"product":{"$ref":"#/components/schemas/ocsfv1.4.0Product","nullable":true,"description":"The product logging the event.  This may be the event source product, a management server product, a scanning product, a SIEM, etc."},"transmit_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the event was transmitted from the logging device to it's next destination."},"transmit_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the event was transmitted from the logging device to it's next destination."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the logging product instance."},"version":{"type":"string","nullable":true,"description":"The version of the logging product."}}}},"components/schemas/ocsfv1.4.0LongString":{"id":"components/schemas/ocsfv1.4.0LongString","kind":"json-schema","title":"ocsfv1.4.0LongString","data":{"title":"ocsfv1.4.0LongString","type":"object","description":"This object is a used to capture strings which may be truncated by a security product due to their length.","properties":{"is_truncated":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" has been truncated. May be omitted if truncation has not occurred."},"children":[],"type":"text"}],"type":"paragraph"}]},"untruncated_size":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The size in bytes of the string represented by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" before truncation. Should be omitted if truncation has not occurred."},"children":[],"type":"text"}],"type":"paragraph"}]},"value":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The string value, truncated if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"is_truncated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["value"]}},"components/schemas/ocsfv1.4.0Malware":{"id":"components/schemas/ocsfv1.4.0Malware","kind":"json-schema","title":"ocsfv1.4.0Malware","data":{"title":"ocsfv1.4.0Malware","type":"object","description":"The Malware object describes the classification of known malicious software, which is intentionally designed to cause damage to a computer, server, client, or computer network.","properties":{"classification_ids":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Malware_ClassificationIds"},"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of normalized identifiers of the malware classifications. Reference: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_oxlc4df65spl"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"STIX Malware Types"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"classifications":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of malware classifications, normalized to the captions of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"classification_ids"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" values. In the case of 'Other', they are defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"cves":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Cve"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"List of Common Vulnerabilities and Exposures ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cve.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVE"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","nullable":true,"description":"The malware name, as reported by the detection engine."},"path":{"type":"string","nullable":true,"description":"The filesystem path of the malware that was observed."},"provider":{"type":"string","nullable":true,"description":"The provider of the malware information."},"uid":{"type":"string","nullable":true,"description":"The malware unique identifier, as reported by the detection engine. For example a virus id or an IPS signature id."}},"required":["classification_ids"]}},"components/schemas/ocsfv1.4.0Malware_ClassificationIds":{"id":"components/schemas/ocsfv1.4.0Malware_ClassificationIds","kind":"json-schema","title":"ocsfv1.4.0Malware_ClassificationIds","data":{"title":"ocsfv1.4.0Malware_ClassificationIds","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MalwareClassificationIds is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The classification is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Adware"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Backdoor"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Bot"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Bootkit"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - DDOS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Downloader"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Dropper"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Kit"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Keylogger"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Ransomware"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Access_Trojan"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Exploitation"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Security_Software"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Rootkit"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - Capture"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Spyware"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Trojan"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Virus"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Webshell"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Wiper"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Worm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The classification is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"classifications"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Metadata":{"id":"components/schemas/ocsfv1.4.0Metadata","kind":"json-schema","title":"ocsfv1.4.0Metadata","data":{"title":"ocsfv1.4.0Metadata","type":"object","description":"The Metadata object describes the metadata associated with the event.","properties":{"correlation_uid":{"type":"string","nullable":true,"description":"The unique identifier used to correlate events."},"debug":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Debug information about non-fatal issues with this OCSF event. Each issue is a line in this string array."},"event_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Event ID, Code, or Name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" that the product uses to primarily identify the event."},"children":[],"type":"text"}],"type":"paragraph"}]},"extension":{"$ref":"#/components/schemas/ocsfv1.4.0Extension","nullable":true,"description":"The schema extension used to create the event."},"extensions":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Extension"},"nullable":true,"description":"The schema extensions used to create the event."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of labels attached to the event. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[\"sample\", \"dev\"]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"log_level":{"type":"string","nullable":true,"description":"The audit level at which an event was generated."},"log_name":{"type":"string","nullable":true,"description":"The event log name. For example, syslog file name or Windows logging subsystem: Security."},"log_provider":{"type":"string","nullable":true,"description":"The logging provider or logging service that logged the event. For example, Microsoft-Windows-Security-Auditing."},"log_version":{"type":"string","nullable":true,"description":"The event log schema version that specifies the format of the original event. For example syslog version or Cisco Log Schema Version."},"logged_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The time when the logging system collected and logged the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different."},"children":[],"type":"text"}]},"logged_time_dt":{"type":"string","format":"date-time","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The time when the logging system collected and logged the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different."},"children":[],"type":"text"}]},"loggers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Logger"},"nullable":true,"description":"An array of Logger objects that describe the devices and logging products between the event source and its eventual destination. Note, this attribute can be used when there is a complex end-to-end path of event flow."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the event was last modified or enriched."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the event was last modified or enriched."},"original_time":{"type":"string","nullable":true,"description":"The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs."},"processed_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The event processed time, such as an ETL operation."},"processed_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The event processed time, such as an ETL operation."},"product":{"$ref":"#/components/schemas/ocsfv1.4.0Product","description":"The product that reported the event."},"profiles":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of profiles used to create the event.  Profiles should be referenced by their "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for core profiles, or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"extension/name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for profiles from extensions."},"children":[],"type":"text"}],"type":"paragraph"}]},"sequence":{"type":"integer","nullable":true,"description":"Sequence number of the event. The sequence number is a value available in some events, to make the exact ordering of events unambiguous, regardless of the event time precision."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the event."},"children":[],"type":"text"}],"type":"paragraph"}]},"tenant_uid":{"type":"string","nullable":true,"description":"The unique tenant identifier."},"uid":{"type":"string","nullable":true,"description":"The logging system-assigned unique identifier of an event instance."},"version":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The version of the OCSF schema, using Semantic Versioning Specification ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://semver.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SemVer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"). For example: 1.0.0. Event consumers use the version to determine the available event attributes."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["product","version"]}},"components/schemas/ocsfv1.4.0Metric":{"id":"components/schemas/ocsfv1.4.0Metric","kind":"json-schema","title":"ocsfv1.4.0Metric","data":{"title":"ocsfv1.4.0Metric","type":"object","description":"The Metric object defines a simple name/value pair entity for a metric.","properties":{"name":{"type":"string","description":"The name of the metric."},"value":{"type":"string","description":"The value of the metric."}},"required":["name","value"]}},"components/schemas/ocsfv1.4.0NetworkInterface":{"id":"components/schemas/ocsfv1.4.0NetworkInterface","kind":"json-schema","title":"ocsfv1.4.0NetworkInterface","data":{"title":"ocsfv1.4.0NetworkInterface","type":"object","description":"The Network Interface object describes the type and associated attributes of a network interface.","properties":{"hostname":{"$ref":"#/components/schemas/ocsfv1.4.0Hostname","nullable":true,"description":"The hostname associated with the network interface."},"ip":{"$ref":"#/components/schemas/ocsfv1.4.0IPAddress","nullable":true,"description":"The IP address associated with the network interface."},"ip_addresses":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of IP addresses available on the network interface."},"mac":{"$ref":"#/components/schemas/ocsfv1.4.0MACAddress","nullable":true,"description":"The MAC address of the network interface."},"mac_addresses":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of MAC addresses available on the network interface."},"name":{"type":"string","nullable":true,"description":"The name of the network interface."},"namespace":{"type":"string","nullable":true,"description":"The namespace is useful in merger or acquisition situations. For example, when similar entities exist that you need to keep separate."},"subnet_prefix":{"type":"integer","nullable":true,"description":"The subnet prefix length determines the number of bits used to represent the network part of the IP address. The remaining bits are reserved for identifying individual hosts within that subnet."},"type":{"type":"string","nullable":true,"description":"The type of network interface."},"type_id":{"$ref":"#/components/schemas/ocsfv1.4.0NetworkInterface_TypeId","description":"The network interface type identifier."},"uid":{"type":"string","nullable":true,"description":"The unique identifier for the network interface."}},"required":["type_id"]}},"components/schemas/ocsfv1.4.0NetworkInterface_TypeId":{"id":"components/schemas/ocsfv1.4.0NetworkInterface_TypeId","kind":"json-schema","title":"ocsfv1.4.0NetworkInterface_TypeId","data":{"title":"ocsfv1.4.0NetworkInterface_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkInterfaceTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Wired"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Wireless"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Mobile"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Tunnel"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Object":{"id":"components/schemas/ocsfv1.4.0Object","kind":"json-schema","title":"ocsfv1.4.0Object","data":{"title":"ocsfv1.4.0Object","type":"object","additionalProperties":true,"description":"An unordered collection of attributes. It defines a set of attributes available in all objects. It can be also used as a generic object to log objects that are not otherwise defined by the schema."}},"components/schemas/ocsfv1.4.0Observable":{"id":"components/schemas/ocsfv1.4.0Observable","kind":"json-schema","title":"ocsfv1.4.0Observable","data":{"title":"ocsfv1.4.0Observable","type":"object","description":"The observable object is a pivot element that contains related information found in many places in the event.","properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full name of the observable attribute. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is a pointer/reference to an attribute within the OCSF event data. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"file.name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"reputation":{"$ref":"#/components/schemas/ocsfv1.4.0Reputation","nullable":true,"description":"Contains the original and normalized reputation scores."},"type":{"type":"string","nullable":true,"description":"The observable value type name."},"type_id":{"$ref":"#/components/schemas/ocsfv1.4.0Observable_TypeId","description":"The observable value type identifier."},"value":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The value associated with the observable attribute. The meaning of the value depends on the observable type."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" refers to a scalar attribute, then the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is the value of the attribute."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" refers to an object attribute, then the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is not populated."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["type_id"]}},"components/schemas/ocsfv1.4.0Observable_TypeId":{"id":"components/schemas/ocsfv1.4.0Observable_TypeId","kind":"json-schema","title":"ocsfv1.4.0Observable_TypeId","data":{"title":"ocsfv1.4.0Observable_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ObservableTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: Unknown observable data type."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Hostname: Unique name assigned to a device connected to a computer network. It may be a fully qualified domain name (FQDN). For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"r2-d2.example.com."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":","},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mx.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or IPv6 format. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"192.168.200.24"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2001:0db8:85a3:0000:0000:8a2e:0370:7334"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - MACAddress: Media Access Control (MAC) address. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"18:36:F3:98:4F:9A"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - UserName: User name. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"john_doe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - EmailAddress: Email address. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"john_doe@example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - URLString: Uniform Resource Locator (URL) string. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http://www.example.com/download/trouble.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - FileName: File name. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"text-file.txt"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Hash: Hash. A unique value that corresponds to the content of the file, image, ja3_hash or hassh found in the schema. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" MD5: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3172ac7e2b55cbb81f04a6e65855a628"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - ProcessName: Process name. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notepad"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - ResourceUID: Resource unique identifier. For example, S3 Bucket name or EC2 Instance ID."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Port: The TCP/UDP port number. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"80"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":","},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"22"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - Subnet: The subnet represented in a CIDR notation, using the format network_address/prefix_length. The network_address can be in either IPv4 or IPv6 format. The prefix length indicates the number of bits used for the network portion, and the remaining bits are available for host addresses within that subnet. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"192.168.1.0/24"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":","},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2001:0db8:85a3:0000::/64"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Endpoint: The Endpoint object describes a physical or virtual device that connects to and exchanges information with a computer network. Some examples of endpoints are mobile devices, desktop computers, virtual machines, embedded devices, and servers. Internet-of-Things devices—like cameras, lighting, refrigerators, security systems, smart speakers, and thermostats—are also endpoints."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - User: The User object describes the characteristics of a user/person or a security principal."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Email: The Email object describes the email metadata such as sender, recipients, and direction, and can include embedded URLs and files."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - UniformResourceLocator: The Uniform Resource Locator (URL) object describes the characteristics of a URL."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - File: The File object represents the metadata associated with a file stored in a computer system. It encompasses information about the file itself, including its attributes, properties, and organizational details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Process: The Process object describes a running instance of a launched program."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - GeoLocation: The Geo Location object describes a geographical location, usually associated with an IP address."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Container: The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"30 - Fingerprint: The Fingerprint object provides detailed information about a digital fingerprint, which is a compact representation of data used to identify a longer piece of information, such as a public key or file content. It contains the algorithm and value of the fingerprint, enabling efficient and reliable identification of the associated data."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The observable data type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which may contain data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Organization":{"id":"components/schemas/ocsfv1.4.0Organization","kind":"json-schema","title":"ocsfv1.4.0Organization","data":{"title":"ocsfv1.4.0Organization","type":"object","description":"The Organization object describes characteristics of an organization or company and its division if any. Additionally, it also describes cloud and Software-as-a-Service (SaaS) logical hierarchies such as AWS Organizations, Google Cloud Organizations, Oracle Cloud Tenancies, and similar constructs.","properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the organization, Oracle Cloud Tenancy, Google Cloud Organization, or AWS Organization. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Widget, Inc. "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" AWS Organization name "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"ou_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of an organizational unit, Google Cloud Folder, or AWS Org Unit. For example, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" GCP Project Name "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Dev_Prod_OU "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"ou_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of an organizational unit, Google Cloud Folder, or AWS Org Unit. For example, an  "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Oracle Cloud Tenancy ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" AWS OU ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" GCP Folder ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the organization, Oracle Cloud Tenancy, Google Cloud Organization, or AWS Organization. For example, an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" AWS Org ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Oracle Cloud Domain ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.4.0Os":{"id":"components/schemas/ocsfv1.4.0Os","kind":"json-schema","title":"ocsfv1.4.0Os","data":{"title":"ocsfv1.4.0Os","type":"object","description":"The Operating System (OS) object describes characteristics of an OS, such as Linux or Windows.","properties":{"build":{"type":"string","nullable":true,"description":"The operating system build number."},"country":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The operating system country code, as defined by the ISO 3166-1 standard (Alpha-2 code)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" The two letter country code should be capitalized. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"US"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CA"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"cpe_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Platform Enumeration (CPE) name as described by ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://nvd.nist.gov/products/cpe"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpe:/a:apple:safari:16.2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_bits":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cpu architecture, the number of bits used for addressing in memory. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"32"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"64"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"edition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The operating system edition. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Professional"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"kernel_release":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The kernel release of the operating system. On Unix-based systems, this is determined from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"uname -r"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" command output, for example \"5.15.0-122-generic\"."},"children":[],"type":"text"}],"type":"paragraph"}]},"lang":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The two letter lower case language codes, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/ISO_639-1"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ISO 639-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"en"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (English), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"de"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (German), or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"fr"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (French)."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","description":"The operating system name."},"sp_name":{"type":"string","nullable":true,"description":"The name of the latest Service Pack."},"sp_ver":{"type":"integer","nullable":true,"description":"The version number of the latest Service Pack."},"type":{"type":"string","nullable":true,"description":"The type of the operating system."},"type_id":{"$ref":"#/components/schemas/ocsfv1.4.0Os_TypeId","description":"The type identifier of the operating system."},"version":{"type":"string","nullable":true,"description":"The version of the OS running on the device that originated the event. For example: \"Windows 10\", \"OS X 10.7\", or \"iOS 9\"."}},"required":["name","type_id"]}},"components/schemas/ocsfv1.4.0Os_TypeId":{"id":"components/schemas/ocsfv1.4.0Os_TypeId","kind":"json-schema","title":"ocsfv1.4.0Os_TypeId","data":{"title":"ocsfv1.4.0Os_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OsTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"100 - Windows"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"101 - WindowsMobile"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"200 - Linux"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"201 - Android"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"300 - macOS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"301 - iOS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"302 - iPadOS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400 - Solaris"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"401 - AIX"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"402 - UX"},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Osint":{"id":"components/schemas/ocsfv1.4.0Osint","kind":"json-schema","title":"ocsfv1.4.0Osint","data":{"title":"ocsfv1.4.0Osint","type":"object","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","properties":{"answers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0DnsAnswer"},"nullable":true,"description":"Any pertinent DNS answers information related to an indicator or OSINT analysis."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK Tactics, Techniques, and/or Procedures (TTPs) pertinent to an indicator or OSINT analysis."},"children":[],"type":"text"}],"type":"paragraph"}]},"autonomous_system":{"$ref":"#/components/schemas/ocsfv1.4.0AutonomousSystem","nullable":true,"description":"Any pertinent autonomous system information related to an indicator or OSINT analysis."},"comment":{"type":"string","nullable":true,"description":"Analyst commentary or source commentary about an indicator or OSINT analysis."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence of an indicator being malicious and/or pertinent, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source or analyst."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.4.0Osint_ConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of collected information related to the OSINT or how pertinent an indicator or analysis is to a specific event or finding. A low confidence means that the information collected or analysis conducted lacked detail or is not accurate enough to qualify an indicator as fully malicious."},"email":{"$ref":"#/components/schemas/ocsfv1.4.0Email","nullable":true,"description":"Any email information pertinent to an indicator or OSINT analysis."},"email_auth":{"$ref":"#/components/schemas/ocsfv1.4.0EmailAuth","nullable":true,"description":"Any email authentication information pertinent to an indicator or OSINT analysis."},"file":{"$ref":"#/components/schemas/ocsfv1.4.0File","nullable":true,"description":"Any pertinent file information related to an indicator or OSINT analysis."},"kill_chain":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0KillChainPhase"},"nullable":true,"description":"Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT analysis."},"location":{"$ref":"#/components/schemas/ocsfv1.4.0Location","nullable":true,"description":"Any pertinent geolocation information related to an indicator or OSINT analysis."},"name":{"type":"string","nullable":true,"description":"The name of the entity."},"related_analytics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Analytic"},"nullable":true,"description":"Any analytics related to an indicator or OSINT analysis."},"reputation":{"$ref":"#/components/schemas/ocsfv1.4.0Reputation","nullable":true,"description":"Related reputational analysis from third-party engines and analysts for a given indicator or OSINT analysis."},"script":{"$ref":"#/components/schemas/ocsfv1.4.0Script","nullable":true,"description":"Any pertinent script information related to an indicator or OSINT analysis."},"signatures":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0DigitalSignature"},"nullable":true,"description":"Any digital signatures or hashes related to an indicator or OSINT analysis."},"src_url":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":"The source URL of an indicator or OSINT analysis, e.g., a URL back to a TIP, report, or otherwise."},"subdomains":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Any pertinent subdomain information - such as those generated by a Domain Generation Algorithm - related to an indicator or OSINT analysis."},"subnet":{"$ref":"#/components/schemas/ocsfv1.4.0Subnet","nullable":true,"description":"A CIDR or network block related to an indicator or OSINT analysis."},"tlp":{"$ref":"#/components/schemas/ocsfv1.4.0Osint_Tlp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/tlp/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Traffic Light Protocol"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" was created to facilitate greater sharing of potentially sensitive information and more effective collaboration. TLP provides a simple and intuitive schema for indicating with whom potentially sensitive information can be shared."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":"The OSINT indicator type."},"type_id":{"$ref":"#/components/schemas/ocsfv1.4.0Osint_TypeId","description":"The OSINT indicator type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the entity."},"value":{"type":"string","description":"The actual indicator value in scope, e.g., a SHA-256 hash hexdigest or a domain name."},"vendor_name":{"type":"string","nullable":true,"description":"The vendor name of a tool which generates intelligence or provides indicators."},"vulnerabilities":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Vulnerability"},"nullable":true,"description":"Any vulnerabilities related to an indicator or OSINT analysis."},"whois":{"$ref":"#/components/schemas/ocsfv1.4.0Whois","nullable":true,"description":"Any pertinent WHOIS information related to an indicator or OSINT analysis."}},"required":["type_id","value"]}},"components/schemas/ocsfv1.4.0Osint_ConfidenceId":{"id":"components/schemas/ocsfv1.4.0Osint_ConfidenceId","kind":"json-schema","title":"ocsfv1.4.0Osint_ConfidenceId","data":{"title":"ocsfv1.4.0Osint_ConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OsintConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Osint_Tlp":{"id":"components/schemas/ocsfv1.4.0Osint_Tlp","kind":"json-schema","title":"ocsfv1.4.0Osint_Tlp","data":{"title":"ocsfv1.4.0Osint_Tlp","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OsintTlp is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only spread this on a need-to-know basis within their organization and its clients. Note that TLP:AMBER+STRICT restricts sharing to the organization only. Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risk to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may share TLP:AMBER information with members of their own organization and its clients, but only on a need-to-know basis to protect their organization and its clients and prevent further harm. Note: if the source wants to restrict sharing to the organization only, they must specify TLP:AMBER+STRICT."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure, recipients can only spread this on a need-to-know basis within their organization and its clients. Note that TLP:AMBER+STRICT restricts sharing to the organization only. Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risk to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may share TLP:AMBER information with members of their own organization and its clients, but only on a need-to-know basis to protect their organization and its clients and prevent further harm. Note: if the source wants to restrict sharing to the organization only, they must specify TLP:AMBER+STRICT."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the world, there is no limit on disclosure. Sources may use TLP:CLEAR when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be shared without restriction."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can spread this within their community. Sources may use TLP:GREEN when information is useful to increase awareness within their wider community. Recipients may share TLP:GREEN information with peers and partner organizations within their community, but not via publicly accessible channels. TLP:GREEN information may not be shared outside of the community. Note: when “community” is not defined, assume the cybersecurity/defense community."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"RED - RED: TLP:RED is for the eyes and ears of individual recipients only, no further disclosure. Sources may use TLP:RED when information cannot be effectively acted upon without significant risk for the privacy, reputation, or operations of the organizations involved. Recipients may therefore not share TLP:RED information with anyone else. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"WHITE - WHITE: TLP:WHITE and TLP:CLEAR may be used interchangeably, TLP:WHITE is the most up to date (as of TLP 2.0) usage."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Osint_TypeId":{"id":"components/schemas/ocsfv1.4.0Osint_TypeId","kind":"json-schema","title":"ocsfv1.4.0Osint_TypeId","data":{"title":"ocsfv1.4.0Osint_TypeId","type":"integer","description":"OsintTypeId is an enum, and the following values are allowed.\n0 - Unknown: The indicator type is ambiguous or there is not a related indicator for the OSINT object.\n1 - IPAddress: An IPv4 or IPv6 address.\n2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial domain.\n3 - Hostname: A hostname or computer name.\n4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, SSDEEP, VHASH, etc. generated from a file, malware sample, request header, or otherwise used to identify a pertinent artifact.\n5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator (URI).\n6 - UserAgent: A User Agent typically seen in HTTP request headers.\n7 - DigitalCertificate: The serial number, fingerprint, or full content of an X.509 digital certificate.\n8 - Email: The contents of an email or any related information to an email object.\n9 - EmailAddress: An email address.\n10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a weakness, exploit, bug, or misconfiguration.\n11 - File: A file or metadata about a file.\n12 - RegistryKey: A Windows Registry Key.\n13 - RegistryValue: A Windows Registry Value.\n14 - CommandLine: A partial or full Command Line used to invoke scripts or other remote commands.\n99 - Other: The indicator type is not directly listed."}},"components/schemas/ocsfv1.4.0Package":{"id":"components/schemas/ocsfv1.4.0Package","kind":"json-schema","title":"ocsfv1.4.0Package","data":{"title":"ocsfv1.4.0Package","type":"object","description":"The Software Package object describes details about a software package.","properties":{"architecture":{"type":"string","nullable":true,"description":"Architecture is a shorthand name describing the type of computer hardware the packaged software is meant to run on."},"cpe_name":{"type":"string","nullable":true,"description":"The Common Platform Enumeration (CPE) name for the software package."},"epoch":{"type":"integer","nullable":true,"description":"The software package epoch. Epoch is a way to define weighted dependencies based on version numbers."},"hash":{"$ref":"#/components/schemas/ocsfv1.4.0Fingerprint","nullable":true,"description":"Cryptographic hash to identify the binary instance of a software component. This can include any component such file, package, or library."},"license":{"type":"string","nullable":true,"description":"The software license applied to this package."},"name":{"type":"string","description":"The software package name."},"purl":{"type":"string","nullable":true,"description":"A purl is a URL string used to identify and locate a software package in a mostly universal and uniform way across programming languages, package managers, packaging conventions, tools, APIs and databases."},"release":{"type":"string","nullable":true,"description":"Release is the number of times a version of the software has been packaged."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of software package, normalized to the caption of the type_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.4.0Package_TypeId","nullable":true,"description":"The type of software package."},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor who published the software package."},"version":{"type":"string","description":"The software package version."}},"required":["name","version"]}},"components/schemas/ocsfv1.4.0Package_TypeId":{"id":"components/schemas/ocsfv1.4.0Package_TypeId","kind":"json-schema","title":"ocsfv1.4.0Package_TypeId","data":{"title":"ocsfv1.4.0Package_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"PackageTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Application: An application software package."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - OperatingSystem: An operating system software package."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Policy":{"id":"components/schemas/ocsfv1.4.0Policy","kind":"json-schema","title":"ocsfv1.4.0Policy","data":{"title":"ocsfv1.4.0Policy","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Policy object describes the policies that are applicable. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Policy attributes provide traceability to the operational state of the security product at the time that the event was captured, facilitating forensics, troubleshooting, and policy tuning/adjustments."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"desc":{"type":"string","nullable":true,"description":"The description of the policy."},"group":{"$ref":"#/components/schemas/ocsfv1.4.0Group","nullable":true,"description":"The policy group."},"is_applied":{"type":"boolean","nullable":true,"description":"A determination if the content of a policy was applied to a target or request, or not."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The policy name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IAM Policy"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"A unique identifier of the policy instance."},"version":{"type":"string","nullable":true,"description":"The policy version number."}}}},"components/schemas/ocsfv1.4.0Process":{"id":"components/schemas/ocsfv1.4.0Process","kind":"json-schema","title":"ocsfv1.4.0Process","data":{"title":"ocsfv1.4.0Process","type":"object","description":"The Process object describes a running instance of a launched program.","properties":{"ancestry":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0ProcessEntity"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of Process Entities describing the extended parentage of this process object. Direct parent information sould be expressed through the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"parent_process"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute. The first array element is the direct parent of this process object. Subsequent list elements go up the process parentage hierarchy. That is, the array is sorted from newest to oldest process. It is recommended to only populate this field for the top-level process object."},"children":[],"type":"text"}],"type":"paragraph"}]},"auid":{"type":"integer","nullable":true,"description":"The audit user assigned at login by the audit subsystem."},"cmd_line":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full command line used to launch an application, service, process, or job. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ssh user@10.0.0.10"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". If the command line is unavailable or missing, the empty string "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"''"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is to be used."},"children":[],"type":"text"}],"type":"paragraph"}]},"container":{"$ref":"#/components/schemas/ocsfv1.4.0Container","nullable":true,"description":"The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd."},"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the process was created/started."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the process was created/started."},"egid":{"type":"integer","nullable":true,"description":"The effective group under which this process is running."},"environment_variables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0EnvironmentVariable"},"nullable":true,"description":"Environment variables associated with the process."},"euid":{"type":"integer","nullable":true,"description":"The effective user under which this process is running."},"file":{"$ref":"#/components/schemas/ocsfv1.4.0File","nullable":true,"description":"The process file object."},"group":{"$ref":"#/components/schemas/ocsfv1.4.0Group","nullable":true,"description":"The group under which this process is running."},"integrity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The process integrity level, normalized to the caption of the integrity_id value. In the case of 'Other', it is defined by the event source (Windows only)."},"children":[],"type":"text"}],"type":"paragraph"}]},"integrity_id":{"$ref":"#/components/schemas/ocsfv1.4.0Process_IntegrityId","nullable":true,"description":"The normalized identifier of the process integrity level (Windows only)."},"lineage":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The lineage of the process, represented by a list of paths for each ancestor process. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"['/usr/sbin/sshd', '/usr/bin/bash', '/usr/bin/whoami']"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"loaded_modules":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of loaded module names."},"name":{"$ref":"#/components/schemas/ocsfv1.4.0ProcessName","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The friendly name of the process, for example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notepad++"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"namespace_pid":{"type":"integer","nullable":true,"description":"If running under a process namespace (such as in a container), the process identifier within that process namespace."},"parent_process":{"$ref":"#/components/schemas/ocsfv1.4.0Object","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The parent process of this process object. It is recommended to only populate this field for the top-level process object, to prevent deep nesting. Additional ancestry information can be supplied in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ancestry"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute."},"children":[],"type":"text"}],"type":"paragraph"}]},"path":{"type":"string","nullable":true,"description":"The process file path."},"pid":{"type":"integer","nullable":true,"description":"The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process."},"sandbox":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps."},"children":[],"type":"text"}],"type":"paragraph"}]},"session":{"$ref":"#/components/schemas/ocsfv1.4.0Session","nullable":true,"description":"The user session under which this process is running."},"terminated_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the process was terminated."},"terminated_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the process was terminated."},"tid":{"type":"integer","nullable":true,"description":"The Identifier of the thread associated with the event, as returned by the operating system."},"uid":{"type":"string","nullable":true,"description":"A unique identifier for this process assigned by the producer (tool).  Facilitates correlation of a process event with other events for that process."},"user":{"$ref":"#/components/schemas/ocsfv1.4.0User","nullable":true,"description":"The user under which this process is running."},"working_directory":{"type":"string","nullable":true,"description":"The working directory of a process."},"xattributes":{"$ref":"#/components/schemas/ocsfv1.4.0Object","nullable":true,"description":"An unordered collection of zero or more name/value pairs that represent a process extended attribute."}}}},"components/schemas/ocsfv1.4.0Process_IntegrityId":{"id":"components/schemas/ocsfv1.4.0Process_IntegrityId","kind":"json-schema","title":"ocsfv1.4.0Process_IntegrityId","data":{"title":"ocsfv1.4.0Process_IntegrityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ProcessIntegrityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The integrity level is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Untrusted"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - System"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Protected"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The integrity level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"integrity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0ProcessEntity":{"id":"components/schemas/ocsfv1.4.0ProcessEntity","kind":"json-schema","title":"ocsfv1.4.0ProcessEntity","data":{"title":"ocsfv1.4.0ProcessEntity","type":"object","description":"The Process Entity object provides critical fields for referencing a process.","properties":{"cmd_line":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full command line used to launch an application, service, process, or job. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ssh user@10.0.0.10"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". If the command line is unavailable or missing, the empty string "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"''"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is to be used."},"children":[],"type":"text"}],"type":"paragraph"}]},"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the process was created/started."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the process was created/started."},"name":{"$ref":"#/components/schemas/ocsfv1.4.0ProcessName","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The friendly name of the process, for example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notepad++"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"path":{"type":"string","nullable":true,"description":"The process file path."},"pid":{"type":"integer","nullable":true,"description":"The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process."},"uid":{"type":"string","nullable":true,"description":"A unique identifier for this process assigned by the producer (tool).  Facilitates correlation of a process event with other events for that process."}}}},"components/schemas/ocsfv1.4.0Product":{"id":"components/schemas/ocsfv1.4.0Product","kind":"json-schema","title":"ocsfv1.4.0Product","data":{"title":"ocsfv1.4.0Product","type":"object","description":"The Product object describes characteristics of a software product.","properties":{"cpe_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Platform Enumeration (CPE) name as described by ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://nvd.nist.gov/products/cpe"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpe:/a:apple:safari:16.2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"distribution_mode":{"type":"string","nullable":true,"description":"Indicates the source from which the app was installed, such as the app store."},"feature":{"$ref":"#/components/schemas/ocsfv1.4.0Feature","nullable":true,"description":"The feature that reported the event."},"lang":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The two letter lower case language codes, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/ISO_639-1"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ISO 639-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"en"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (English), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"de"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (German), or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"fr"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (French)."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","nullable":true,"description":"The name of the product."},"path":{"type":"string","nullable":true,"description":"The installation path of the product."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the product."},"url_string":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":"The URL pointing towards the product."},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor of the product."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The version of the product, as defined by the event source. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2013.1.3-beta"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"workload":{"type":"string","nullable":true,"description":"The product workload associated with the event."}}}},"components/schemas/ocsfv1.4.0Remediation":{"id":"components/schemas/ocsfv1.4.0Remediation","kind":"json-schema","title":"ocsfv1.4.0Remediation","data":{"title":"ocsfv1.4.0Remediation","type":"object","description":"The Remediation object describes the recommended remediation steps to address identified issue(s).","properties":{"desc":{"type":"string","description":"The description of the remediation strategy."},"kb_article_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0KbArticle"},"nullable":true,"description":"A list of KB articles or patches related to an endpoint. A KB Article contains metadata that describes the patch or an update."},"kb_articles":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The KB article/s related to the entity. A KB Article contains metadata that describes the patch or an update."},"references":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of supporting URL/s, references that help describe the remediation strategy."}},"required":["desc"]}},"components/schemas/ocsfv1.4.0Reputation":{"id":"components/schemas/ocsfv1.4.0Reputation","kind":"json-schema","title":"ocsfv1.4.0Reputation","data":{"title":"ocsfv1.4.0Reputation","type":"object","description":"The Reputation object describes the reputation/risk score of an entity (e.g. device, user, domain).","properties":{"base_score":{"type":"number","format":"double","description":"The reputation score as reported by the event source."},"provider":{"type":"string","nullable":true,"description":"The provider of the reputation information."},"score":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The reputation score, normalized to the caption of the score_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"score_id":{"$ref":"#/components/schemas/ocsfv1.4.0Reputation_ScoreId","description":"The normalized reputation score identifier."}},"required":["base_score","score_id"]}},"components/schemas/ocsfv1.4.0Reputation_ScoreId":{"id":"components/schemas/ocsfv1.4.0Reputation_ScoreId","kind":"json-schema","title":"ocsfv1.4.0Reputation_ScoreId","data":{"title":"ocsfv1.4.0Reputation_ScoreId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ReputationScoreId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The reputation score is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - VerySafe: Long history of good behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Safe: Consistently good behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - ProbablySafe: Reasonable history of good behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - LeansSafe: Starting to establish a history of normal behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - MaynotbeSafe: No established history of normal behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - ExerciseCaution: Starting to establish a history of suspicious or risky behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Risky: A site with a history of suspicious or risky behavior. (spam, scam, potentially unwanted software, potentially malicious)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - PossiblyMalicious: Strong possibility of maliciousness."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - ProbablyMalicious: Indicators of maliciousness."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Malicious: Proven evidence of maliciousness."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The reputation score is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"rep_score"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Request":{"id":"components/schemas/ocsfv1.4.0Request","kind":"json-schema","title":"ocsfv1.4.0Request","data":{"title":"ocsfv1.4.0Request","type":"object","description":"The Request Elements object describes characteristics of an API request.","properties":{"containers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Container"},"nullable":true,"description":"When working with containerized applications, the set of containers which write to the standard the output of a particular logging driver. For example, this may be the set of containers involved in handling api requests and responses for a containerized application."},"data":{"nullable":true,"description":"The additional data that is associated with the api request."},"flags":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The communication flags that are associated with the api request."},"uid":{"type":"string","description":"The unique request identifier."}},"required":["uid"]}},"components/schemas/ocsfv1.4.0ResourceDetails":{"id":"components/schemas/ocsfv1.4.0ResourceDetails","kind":"json-schema","title":"ocsfv1.4.0ResourceDetails","data":{"title":"ocsfv1.4.0ResourceDetails","type":"object","description":"The Resource Details object describes details about resources that were affected by the activity/event.","properties":{"agent_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Agent"},"nullable":true,"description":"A list of agent objects associated with a device, endpoint, or resource."},"cloud_partition":{"type":"string","nullable":true,"description":"The canonical cloud partition name to which the region is assigned (e.g. AWS Partitions: aws, aws-cn, aws-us-gov)."},"criticality":{"type":"string","nullable":true,"description":"The criticality of the resource as defined by the event source."},"data":{"nullable":true,"description":"Additional data describing the resource."},"group":{"$ref":"#/components/schemas/ocsfv1.4.0Group","nullable":true,"description":"The name of the related resource group."},"hostname":{"$ref":"#/components/schemas/ocsfv1.4.0Hostname","nullable":true,"description":"The fully qualified name of the resource."},"ip":{"$ref":"#/components/schemas/ocsfv1.4.0IPAddress","nullable":true,"description":"The IP address associated with the resource."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels/tags associated to a resource."},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The timestamp when the resource was last observed or reported."},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the resource was last observed or reported."},"mac":{"$ref":"#/components/schemas/ocsfv1.4.0MACAddress","nullable":true,"description":"The MAC address associated with the resource."},"name":{"type":"string","nullable":true,"description":"The name of the resource."},"namespace":{"type":"string","nullable":true,"description":"The namespace is useful when similar entities exist that you need to keep separate."},"os_type":{"type":"string","nullable":true,"description":"The type of operating system running on the resource."},"owner":{"$ref":"#/components/schemas/ocsfv1.4.0User","nullable":true,"description":"The identity of the service or user account that owns the resource."},"region":{"type":"string","nullable":true,"description":"The cloud region of the resource."},"src_url":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":"The URL of the resource in the event sources system."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":"The resource type as defined by the event source."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the resource."},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor."},"vendor_uuid":{"type":"string","nullable":true,"description":"The UUID of the vendor."},"version":{"type":"string","nullable":true,"description":"The version of the resource. For example 1.2.3."}}}},"components/schemas/ocsfv1.4.0Response":{"id":"components/schemas/ocsfv1.4.0Response","kind":"json-schema","title":"ocsfv1.4.0Response","data":{"title":"ocsfv1.4.0Response","type":"object","description":"The Response Elements object describes characteristics of an API response.","properties":{"code":{"type":"integer","nullable":true,"description":"The numeric response sent to a request."},"containers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Container"},"nullable":true,"description":"When working with containerized applications, the set of containers which write to the standard the output of a particular logging driver. For example, this may be the set of containers involved in handling api requests and responses for a containerized application."},"data":{"nullable":true,"description":"The additional data that is associated with the api response."},"error":{"type":"string","nullable":true,"description":"Error Code"},"error_message":{"type":"string","nullable":true,"description":"Error Message"},"flags":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The communication flags that are associated with the api response."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."}}}},"components/schemas/ocsfv1.4.0San":{"id":"components/schemas/ocsfv1.4.0San","kind":"json-schema","title":"ocsfv1.4.0San","data":{"title":"ocsfv1.4.0San","type":"object","description":"The Subject Alternative name (SAN) object describes a SAN secured by a digital certificate","properties":{"name":{"type":"string","description":"Name of SAN (e.g. The actual IP Address or domain.)"},"type":{"type":"string","description":"Type descriptor of SAN (e.g. IP Address/domain/etc.)"}},"required":["name","type"]}},"components/schemas/ocsfv1.4.0Scim":{"id":"components/schemas/ocsfv1.4.0Scim","kind":"json-schema","title":"ocsfv1.4.0Scim","data":{"title":"ocsfv1.4.0Scim","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The System for Cross-domain Identity Management (SCIM) Configuration object provides a structured set of attributes related to SCIM protocols used for identity provisioning and management across cloud-based platforms. It standardizes user and group provisioning details, enabling identity synchronization and lifecycle management with compatible Identity Providers (IdPs) and applications. SCIM is defined in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc7643"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-7634"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"auth_protocol":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The authorization protocol as defined by the caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"auth_protocol_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"auth_protocol_id":{"$ref":"#/components/schemas/ocsfv1.4.0Scim_AuthProtocolId","nullable":true,"description":"The normalized identifier of the authorization protocol used by the SCIM resource."},"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"When the SCIM resource was added to the service provider."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"When the SCIM resource was added to the service provider."},"error_message":{"type":"string","nullable":true,"description":"Message or code associated with the last encountered error."},"is_group_provisioning_enabled":{"type":"boolean","nullable":true,"description":"Indicates whether the SCIM resource is configured to provision groups, automatically or otherwise."},"is_user_provisioning_enabled":{"type":"boolean","nullable":true,"description":"Indicates whether the SCIM resource is configured to provision users, automatically or otherwise."},"last_run_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"Timestamp of the most recent successful synchronization."},"last_run_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the most recent successful synchronization."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The most recent time when the SCIM resource was updated at the service provider."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent time when the SCIM resource was updated at the service provider."},"name":{"type":"string","nullable":true,"description":"The name of the SCIM resource."},"protocol_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The supported protocol for the SCIM resource. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SAML"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OIDC"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OAuth2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"rate_limit":{"type":"integer","nullable":true,"description":"Maximum number of requests allowed by the SCIM resource within a specified time frame to avoid throttling."},"scim_group_schema":{"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SCIM provides a schema for representing groups, identified using the following schema URI: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"urn:ietf:params:scim:schemas:core:2.0:Group"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" as defined in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc7643"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-7634"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". This attribute will capture key-value pairs for the scheme implemented in a SCIM resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"scim_user_schema":{"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SCIM provides a resource type for user resources. The core schema for user is identified using the following schema URI: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"urn:ietf:params:scim:schemas:core:2.0:User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" as defined in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc7643"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-7634"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". his attribute will capture key-value pairs for the scheme implemented in a SCIM resource. This object is inclusive of both the basic and Enterprise User Schema Extension."},"children":[],"type":"text"}],"type":"paragraph"}]},"state":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The provisioning state of the SCIM resource, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"state_id":{"$ref":"#/components/schemas/ocsfv1.4.0Scim_StateId","nullable":true,"description":"The normalized state ID of the SCIM resource to reflect its activation status."},"uid":{"type":"string","nullable":true,"description":"A unique identifier for a SCIM resource as defined by the service provider."},"uid_alt":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A String that is an identifier for the resource as defined by the provisioning client. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"externalId"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" may simplify identification of a resource between the provisioning client and the service provider by allowing the client to use a filter to locate the resource with an identifier from the provisioning domain, obviating the need to store a local mapping between the provisioning domain's identifier of the resource and the identifier used by the service provider."},"children":[],"type":"text"}],"type":"paragraph"}]},"url_string":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":"The primary URL for SCIM API requests."},"vendor_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Name of the vendor or service provider implementing SCIM. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Okta"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Auth0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Microsoft"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SCIM protocol version supported e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SCIM 2.0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.4.0Scim_AuthProtocolId":{"id":"components/schemas/ocsfv1.4.0Scim_AuthProtocolId","kind":"json-schema","title":"ocsfv1.4.0Scim_AuthProtocolId","data":{"title":"ocsfv1.4.0Scim_AuthProtocolId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ScimAuthProtocolId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The authentication protocol is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - NTLM"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Kerberos"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Digest"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - OpenID"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - SAML"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - 0"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - PAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - CHAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - EAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - RADIUS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - BasicAuthentication"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The authentication protocol is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"auth_protocol"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Scim_StateId":{"id":"components/schemas/ocsfv1.4.0Scim_StateId","kind":"json-schema","title":"ocsfv1.4.0Scim_StateId","data":{"title":"ocsfv1.4.0Scim_StateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ScimStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The provisioning state of the SCIM resource is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Pending: The SCIM resource is Pending activation or creation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Active: The SCIM resource is in an Active state, or otherwise enabled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Failed: The SCIM resource is in a Failed state."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Deleted: The SCIM resource is in a Deleted state, or otherwise disabled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The provisioning state of the SCIM resource is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Script":{"id":"components/schemas/ocsfv1.4.0Script","kind":"json-schema","title":"ocsfv1.4.0Script","data":{"title":"ocsfv1.4.0Script","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Script object describes a script or command that can be executed by a shell, script engine, or interpreter. Examples include Bash, JavsScript, PowerShell, Python, VBScript, etc. Note that the term "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"em","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"script"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" here denotes not only a script contained within a file but also a script or command typed interactively by a user, supplied on the command line, or provided by some other file-less mechanism."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"file":{"$ref":"#/components/schemas/ocsfv1.4.0File","nullable":true,"description":"Present if this script is associated with a file. Not present in the case of a file-less script."},"hashes":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Fingerprint"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of the script's cryptographic hashes. Note that these hashes are calculated on the script in its original encoding, and not on the normalized UTF-8 encoding found in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"script_content"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","nullable":true,"description":"Unique identifier for the script or macro, independent of the containing file, used for tracking, auditing, and security analysis."},"parent_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This attribute relates a sub-script to a parent script having the matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute. In the case of PowerShell, sub-script execution can be identified by matching the activity correlation ID of the raw ETW events provided by the OS."},"children":[],"type":"text"}],"type":"paragraph"}]},"script_content":{"$ref":"#/components/schemas/ocsfv1.4.0LongString","description":"The script content, normalized to UTF-8 encoding irrespective of its original encoding. When emitting this attribute, it may be appropriate to truncate large scripts. When consuming this attribute, large scripts should be anticipated."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The script type, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.4.0Script_TypeId","description":"The normalized script type ID."},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Some script engines assign a unique ID to each individual execution of a given script. This attribute captures that unique ID. In the case of PowerShell, the unique ID corresponds to the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ScriptBlockId"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in the raw ETW events provided by the OS."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["script_content","type_id"]}},"components/schemas/ocsfv1.4.0Script_TypeId":{"id":"components/schemas/ocsfv1.4.0Script_TypeId","kind":"json-schema","title":"ocsfv1.4.0Script_TypeId","data":{"title":"ocsfv1.4.0Script_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ScriptTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The script type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - WindowsCommandPrompt"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - PowerShell"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Python"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - JavaScript"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - VBScript"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - UnixShell"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - VBA"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The script type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute which contains an event source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Service":{"id":"components/schemas/ocsfv1.4.0Service","kind":"json-schema","title":"ocsfv1.4.0Service","data":{"title":"ocsfv1.4.0Service","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Service object describes characteristics of a service, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. AWS EC2. "},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels associated with the service."},"name":{"type":"string","nullable":true,"description":"The name of the service."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the service."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the service."},"version":{"type":"string","nullable":true,"description":"The version of the service."}}}},"components/schemas/ocsfv1.4.0Session":{"id":"components/schemas/ocsfv1.4.0Session","kind":"json-schema","title":"ocsfv1.4.0Session","data":{"title":"ocsfv1.4.0Session","type":"object","description":"The Session object describes details about an authenticated session. e.g. Session Creation Time, Session Issuer.","properties":{"count":{"type":"integer","nullable":true,"description":"The number of identical sessions spawned from the same source IP, destination IP, application, and content/threat type seen over a period of time."},"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the session was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the session was created."},"credential_uid":{"type":"string","nullable":true,"description":"The unique identifier of the user's credential. For example, AWS Access Key ID."},"expiration_reason":{"type":"string","nullable":true,"description":"The reason which triggered the session expiration."},"expiration_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The session expiration time."},"expiration_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The session expiration time."},"is_mfa":{"type":"boolean","nullable":true,"description":"Indicates whether Multi Factor Authentication was used during authentication."},"is_remote":{"type":"boolean","nullable":true,"description":"The indication of whether the session is remote."},"is_vpn":{"type":"boolean","nullable":true,"description":"The indication of whether the session is a VPN session."},"issuer":{"type":"string","nullable":true,"description":"The identifier of the session issuer."},"terminal":{"type":"string","nullable":true,"description":"The Pseudo Terminal associated with the session. Ex: the tty or pts value."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the session."},"uid_alt":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The alternate unique identifier of the session. e.g. AWS ARN - "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"arn:aws:sts::123344444444:assumed-role/Admin/example-session"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uuid":{"type":"string","nullable":true,"description":"The universally unique identifier of the session."}}}},"components/schemas/ocsfv1.4.0Sso":{"id":"components/schemas/ocsfv1.4.0Sso","kind":"json-schema","title":"ocsfv1.4.0Sso","data":{"title":"ocsfv1.4.0Sso","type":"object","description":"The Single Sign-On (SSO) object provides a structure for normalizing SSO attributes, configuration, and/or settings from Identity Providers.","properties":{"auth_protocol":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The authorization protocol as defined by the caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"auth_protocol_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"auth_protocol_id":{"$ref":"#/components/schemas/ocsfv1.4.0Sso_AuthProtocolId","nullable":true,"description":"The normalized identifier of the authentication protocol used by the SSO resource."},"certificate":{"$ref":"#/components/schemas/ocsfv1.4.0Certificate","nullable":true,"description":"Digital Signature associated with the SSO resource, e.g., SAML X.509 certificate details."},"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"When the SSO resource was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"When the SSO resource was created."},"duration_mins":{"type":"integer","nullable":true,"description":"The duration (in minutes) for an SSO session, after which re-authentication is required."},"idle_timeout":{"type":"integer","nullable":true,"description":"Duration (in minutes) of allowed inactivity before Single Sign-On (SSO) session expiration."},"login_endpoint":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":"URL for initiating an SSO login request."},"logout_endpoint":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":"URL for initiating an SSO logout request, allowing sessions to be terminated across applications."},"metadata_endpoint":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":"URL where metadata about the SSO configuration is available (e.g., for SAML configurations)."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The most recent time when the SSO resource was updated."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent time when the SSO resource was updated."},"name":{"type":"string","nullable":true,"description":"The name of the SSO resource."},"protocol_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The supported protocol for the SSO resource. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SAML"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OIDC"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"scopes":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Scopes define the specific permissions or actions that the client is allowed to perform on behalf of the user. Each scope represents a different set of permissions, and the user can selectively grant or deny access to specific scopes during the authorization process."},"uid":{"type":"string","nullable":true,"description":"A unique identifier for a SSO resource."},"vendor_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Name of the vendor or service provider implementing SSO. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Okta"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Auth0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Microsoft"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.4.0Sso_AuthProtocolId":{"id":"components/schemas/ocsfv1.4.0Sso_AuthProtocolId","kind":"json-schema","title":"ocsfv1.4.0Sso_AuthProtocolId","data":{"title":"ocsfv1.4.0Sso_AuthProtocolId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SsoAuthProtocolId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The authentication protocol is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - NTLM"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Kerberos"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Digest"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - OpenID"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - SAML"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - 0"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - PAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - CHAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - EAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - RADIUS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - BasicAuthentication"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The authentication protocol is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"auth_protocol"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0SubTechnique":{"id":"components/schemas/ocsfv1.4.0SubTechnique","kind":"json-schema","title":"ocsfv1.4.0SubTechnique","data":{"title":"ocsfv1.4.0SubTechnique","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE ATT&CK® Sub Technique object describes the sub technique ID and/or name associated to an attack, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the attack sub technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Scanning IP Blocks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The versioned permalink of the attack sub technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://attack.mitre.org/versions/v14/techniques/T1595/001/"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the attack sub technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"T1595.001"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.4.0Table":{"id":"components/schemas/ocsfv1.4.0Table","kind":"json-schema","title":"ocsfv1.4.0Table","data":{"title":"ocsfv1.4.0Table","type":"object","description":"The table object represents a table within a structured relational database or datastore, which contains columns and rows of data that are able to be create, updated, deleted and queried.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the table was known to have been created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the table was known to have been created."},"desc":{"type":"string","nullable":true,"description":"The description of the table."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Group"},"nullable":true,"description":"The group names to which the table belongs."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The most recent time when any changes, updates, or modifications were made within the table."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent time when any changes, updates, or modifications were made within the table."},"name":{"type":"string","nullable":true,"description":"The table name, ordinarily as assigned by a database administrator."},"size":{"type":"integer","nullable":true,"description":"The size of the data table in bytes."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the table."}}}},"components/schemas/ocsfv1.4.0Tactic":{"id":"components/schemas/ocsfv1.4.0Tactic","kind":"json-schema","title":"ocsfv1.4.0Tactic","data":{"title":"ocsfv1.4.0Tactic","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE ATT&CK® Tactic object describes the tactic ID and/or name that is associated to an attack, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The tactic name that is associated with the attack technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Reconnaissance"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The versioned permalink of the attack tactic, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://attack.mitre.org/versions/v14/tactics/TA0043/"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The tactic ID that is associated with the attack technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TA0043"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.4.0Technique":{"id":"components/schemas/ocsfv1.4.0Technique","kind":"json-schema","title":"ocsfv1.4.0Technique","data":{"title":"ocsfv1.4.0Technique","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE ATT&CK® Technique object describes the technique ID and/or name associated to an attack, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the attack technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Active Scanning"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The versioned permalink of the attack technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://attack.mitre.org/versions/v14/techniques/T1595/"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the attack technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"T1595"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.4.0Timespan":{"id":"components/schemas/ocsfv1.4.0Timespan","kind":"json-schema","title":"ocsfv1.4.0Timespan","data":{"title":"ocsfv1.4.0Timespan","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Time Span object represents different time period durations. If a timespan is fractional, i.e. crosses one period, e.g. a week and 3 days, more than one may be populated since each member is of integral type. In that case "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"duration":{"type":"integer","nullable":true,"description":"The duration of the time span in milliseconds."},"duration_days":{"type":"integer","nullable":true,"description":"The duration of the time span in days."},"duration_hours":{"type":"integer","nullable":true,"description":"The duration of the time span in hours."},"duration_mins":{"type":"integer","nullable":true,"description":"The duration of the time span in minutes."},"duration_months":{"type":"integer","nullable":true,"description":"The duration of the time span in months."},"duration_secs":{"type":"integer","nullable":true,"description":"The duration of the time span in seconds."},"duration_weeks":{"type":"integer","nullable":true,"description":"The duration of the time span in weeks."},"duration_years":{"type":"integer","nullable":true,"description":"The duration of the time span in years."},"type":{"type":"string","nullable":true,"description":"The type of time span duration the object represents."},"type_id":{"$ref":"#/components/schemas/ocsfv1.4.0Timespan_TypeId","nullable":true,"description":"The normalized identifier for the time span duration type."}}}},"components/schemas/ocsfv1.4.0Timespan_TypeId":{"id":"components/schemas/ocsfv1.4.0Timespan_TypeId","kind":"json-schema","title":"ocsfv1.4.0Timespan_TypeId","data":{"title":"ocsfv1.4.0Timespan_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TimespanTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Milliseconds"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Seconds"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Minutes"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Hours"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Days"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Weeks"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Months"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Years"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Url":{"id":"components/schemas/ocsfv1.4.0Url","kind":"json-schema","title":"ocsfv1.4.0Url","data":{"title":"ocsfv1.4.0Url","type":"object","description":"The Uniform Resource Locator (URL) object describes the characteristics of a URL.","properties":{"categories":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Website categorization names, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"category_ids"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" enum values."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_ids":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Url_CategoryIds"},"nullable":true,"description":"The Website categorization identifiers."},"domain":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The domain portion of the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://sub.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"hostname":{"$ref":"#/components/schemas/ocsfv1.4.0Hostname","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL host as extracted from the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"www.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"www.example.com/download/trouble"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"path":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL path as extracted from the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"/download/trouble"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"www.example.com/download/trouble"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"port":{"$ref":"#/components/schemas/ocsfv1.4.0Port","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL port. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"80"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"query_string":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The query portion of the URL. For example: the query portion of the URL "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http://www.example.com/search?q=bad&sort=date"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"q=bad&sort=date"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"resource_type":{"type":"string","nullable":true,"description":"The context in which a resource was retrieved in a web request."},"scheme":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The scheme portion of the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ftp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"sftp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"subdomain":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The subdomain portion of the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"sub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://sub.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"sub2.sub1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://sub2.sub1.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"url_string":{"$ref":"#/components/schemas/ocsfv1.4.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL string. See RFC 1738. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http://www.example.com/download/trouble.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Note: The URL path should not populate the URL string."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.4.0Url_CategoryIds":{"id":"components/schemas/ocsfv1.4.0Url_CategoryIds","kind":"json-schema","title":"ocsfv1.4.0Url_CategoryIds","data":{"title":"ocsfv1.4.0Url_CategoryIds","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UrlCategoryIds is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The Domain/URL category is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - MatureContent"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Pornography"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - SexEducation"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Swimsuit"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Nudity"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Extreme"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Questionable_Illegal"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Gambling"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Hate_Racism"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Weapons"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - Abortion"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Hacking"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Phishing"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Entertainment"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Economy"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Belief"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Alcohol"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - Tobacco"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - ControlledSubstances"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - ChildPornography"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Education"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"29 - CharitableOrganizations"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"30 - Culture"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"31 - FinancialServices"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"32 - Trading"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"33 - Games"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"34 - Legal"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"35 - Military"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"36 - SocialAdvocacy"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"37 - Health"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"38 - Internet"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"40 - Portals"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"43 - Malnets"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"44 - Botnets"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"45 - Careers"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"46 - Media"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"47 - Dating"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"49 - Reference"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"50 - PotentiallyAdult"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"51 - IM_SMS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"52 - Email"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"53 - Forums"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"54 - Religion"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"55 - SocialNetworking"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"56 - Sharing"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"57 - RemoteAccessTools"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"58 - Shopping"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"59 - Auctions"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"60 - RealEstate"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"61 - DailyLiving"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"63 - PersonalSites"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"64 - Dining_Food"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"65 - Recreation"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"66 - Travel"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"67 - Vehicles"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"68 - Jokes"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"71 - SoftwareDownloads"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"83 - to_Peer_P2P_"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"84 - VideoClips"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"85 - BusinessApplications"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"86 - ProxyAvoidance"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"87 - ForKids"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"88 - Analytics"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"89 - WebHosting"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"90 - Uncategorized"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"92 - Suspicious"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"93 - SexualExpression"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"95 - Translation"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"96 - Viewable_Infrastructure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"97 - ContentServers"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"98 - Placeholders"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The Domain/URL category is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"categories"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"101 - Spam"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"102 - PotentiallyUnwantedSoftware"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"103 - DynamicDNSHost"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"106 - Card_Invitations"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"107 - Informational"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"108 - InformationSecurity"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"109 - InternetConnectedDevices"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"110 - InternetTelephony"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"111 - OnlineMeetings"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"112 - MediaSharing"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"113 - AudioStreams"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"114 - VideoStreams"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"118 - CopyrightConcerns"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"121 - Marijuana"},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0User":{"id":"components/schemas/ocsfv1.4.0User","kind":"json-schema","title":"ocsfv1.4.0User","data":{"title":"ocsfv1.4.0User","type":"object","description":"The User object describes the characteristics of a user/person or a security principal.","properties":{"account":{"$ref":"#/components/schemas/ocsfv1.4.0Account","nullable":true,"description":"The user's account or the account associated with the user."},"credential_uid":{"type":"string","nullable":true,"description":"The unique identifier of the user's credential. For example, AWS Access Key ID."},"domain":{"type":"string","nullable":true,"description":"The domain where the user is defined. For example: the LDAP or Active Directory domain."},"email_addr":{"$ref":"#/components/schemas/ocsfv1.4.0EmailAddress","nullable":true,"description":"The user's primary email address."},"forward_addr":{"$ref":"#/components/schemas/ocsfv1.4.0EmailAddress","nullable":true,"description":"The user's forwarding email address."},"full_name":{"type":"string","nullable":true,"description":"The full name of the person, as per the LDAP Common Name attribute (cn)."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Group"},"nullable":true,"description":"The administrative groups to which the user belongs."},"has_mfa":{"type":"boolean","nullable":true,"description":"The user has a multi-factor or secondary-factor device assigned."},"ldap_person":{"$ref":"#/components/schemas/ocsfv1.4.0LdapPerson","nullable":true,"description":"The additional LDAP attributes that describe a person."},"leave_events":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0LeaveEvent"},"nullable":true,"description":"Leave of absence events associated with the person. May include current, past, and future leaves."},"mfa_status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The multi-factor authentication status, normalized to the caption of the mfa_status_id value. In the case of 'Other', it is defined by the data source."},"children":[],"type":"text"}],"type":"paragraph"}]},"mfa_status_id":{"$ref":"#/components/schemas/ocsfv1.4.0User_MfaStatusId","nullable":true,"description":"The normalized identifier of the user's multi-factor authentication status."},"name":{"$ref":"#/components/schemas/ocsfv1.4.0UserName","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The username. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"janedoe1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"on_leave":{"type":"boolean","nullable":true,"description":"True if the person is currently on a leave of absence."},"org":{"$ref":"#/components/schemas/ocsfv1.4.0Organization","nullable":true,"description":"Organization and org unit related to the user."},"phone_number":{"type":"string","nullable":true,"description":"The telephone number of the user."},"privileges":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The user's privileges."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.4.0User_RiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"type":{"type":"string","nullable":true,"description":"The type of the user. For example, System, AWS IAM User, etc."},"type_id":{"$ref":"#/components/schemas/ocsfv1.4.0User_TypeId","nullable":true,"description":"The account type identifier."},"uid":{"type":"string","nullable":true,"description":"The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN."},"uid_alt":{"type":"string","nullable":true,"description":"The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID."},"user_status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The user status, normalized to the caption of the user_status_id value. In the case of 'Other', it is defined by the data source."},"children":[],"type":"text"}],"type":"paragraph"}]},"user_status_id":{"$ref":"#/components/schemas/ocsfv1.4.0User_UserStatusId","nullable":true,"description":"The normalized identifier of the user's status."}}}},"components/schemas/ocsfv1.4.0User_MfaStatusId":{"id":"components/schemas/ocsfv1.4.0User_MfaStatusId","kind":"json-schema","title":"ocsfv1.4.0User_MfaStatusId","data":{"title":"ocsfv1.4.0User_MfaStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UserMfaStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Enabled: Multi-factor authentication is enabled for this user."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - NotEnabled: TMulti-factor authentication is off for this user."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Enforced: Multi-factor authentication is enabled and there is a policy that requires it for this user."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"user_status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0User_RiskLevelId":{"id":"components/schemas/ocsfv1.4.0User_RiskLevelId","kind":"json-schema","title":"ocsfv1.4.0User_RiskLevelId","data":{"title":"ocsfv1.4.0User_RiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UserRiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0User_TypeId":{"id":"components/schemas/ocsfv1.4.0User_TypeId","kind":"json-schema","title":"ocsfv1.4.0User_TypeId","data":{"title":"ocsfv1.4.0User_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UserTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - User: Regular user account."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Admin: Admin/root user account."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - System: System account. For example, Windows computer accounts with a trailing dollar sign ($)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0User_UserStatusId":{"id":"components/schemas/ocsfv1.4.0User_UserStatusId","kind":"json-schema","title":"ocsfv1.4.0User_UserStatusId","data":{"title":"ocsfv1.4.0User_UserStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UserUserStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Active: The user is active."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Pending: The user is not active, pending either user or admin action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Locked: The user account is locked requiring either time or intervention to unlock."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Suspended: The user account is suspended."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deprovisioned: The user account has been deprovisioned and is pending removal."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"user_status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.4.0Vulnerability":{"id":"components/schemas/ocsfv1.4.0Vulnerability","kind":"json-schema","title":"ocsfv1.4.0Vulnerability","data":{"title":"ocsfv1.4.0Vulnerability","type":"object","description":"The vulnerability is an unintended characteristic of a computing component or system configuration that multiplies the risk of an adverse event or a loss occurring either due to accidental exposure, deliberate attack, or conflict with new system components.","properties":{"advisory":{"$ref":"#/components/schemas/ocsfv1.4.0Advisory","nullable":true,"description":"Detail about the security advisory, that is used to publicly disclose cybersecurity vulnerabilities by a vendor."},"affected_code":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0AffectedCode"},"nullable":true,"description":"List of Affected Code objects that describe details about code blocks identified as vulnerable."},"affected_packages":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0AffectedPackage"},"nullable":true,"description":"List of software packages identified as affected by a vulnerability/vulnerabilities."},"category":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The category of a vulnerability or weakness, as reported by the source tool, such as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Container Security"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Open Source Security"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cve":{"$ref":"#/components/schemas/ocsfv1.4.0Cve","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the Common Vulnerabilities and Exposures "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cve.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"(CVE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" details related to the vulnerability."},"children":[],"type":"text"}],"type":"paragraph"}]},"cwe":{"$ref":"#/components/schemas/ocsfv1.4.0Cwe","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the Common Weakness Enumeration "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"(CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" details related to the vulnerability."},"children":[],"type":"text"}],"type":"paragraph"}]},"desc":{"type":"string","nullable":true,"description":"The description of the vulnerability."},"exploit_last_seen_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the exploit was most recently observed."},"exploit_last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the exploit was most recently observed."},"first_seen_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the vulnerability was first observed."},"first_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the vulnerability was first observed."},"fix_available":{"type":"boolean","nullable":true,"description":"Indicates if a fix is available for the reported vulnerability."},"is_exploit_available":{"type":"boolean","nullable":true,"description":"Indicates if an exploit or a PoC (proof-of-concept) is available for the reported vulnerability."},"is_fix_available":{"type":"boolean","nullable":true,"description":"Indicates if a fix is available for the reported vulnerability."},"kb_article_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0KbArticle"},"nullable":true,"description":"A list of KB articles or patches related to an endpoint. A KB Article contains metadata that describes the patch or an update."},"kb_articles":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The KB article/s related to the entity. A KB Article contains metadata that describes the patch or an update."},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"The time when the vulnerability was most recently observed."},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the vulnerability was most recently observed."},"packages":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0Package"},"nullable":true,"description":"List of vulnerable packages as identified by the security product"},"references":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of reference URLs with additional information about the vulnerability."},"related_vulnerabilities":{"type":"array","items":{"type":"string"},"nullable":true,"description":"List of vulnerability IDs (e.g. CVE ID) that are related to this vulnerability."},"remediation":{"$ref":"#/components/schemas/ocsfv1.4.0Remediation","nullable":true,"description":"The remediation recommendations on how to mitigate the identified vulnerability."},"severity":{"type":"string","nullable":true,"description":"The vendor assigned severity of the vulnerability."},"title":{"type":"string","nullable":true,"description":"A title or a brief phrase summarizing the discovered vulnerability."},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor that identified the vulnerability."},"xattributes":{"$ref":"#/components/schemas/ocsfv1.4.0Object","nullable":true,"description":"An unordered collection of zero or more name/value pairs that represent a vulnerability's extended attributes and are specific to the event source."}}}},"components/schemas/ocsfv1.4.0Whois":{"id":"components/schemas/ocsfv1.4.0Whois","kind":"json-schema","title":"ocsfv1.4.0Whois","data":{"title":"ocsfv1.4.0Whois","type":"object","description":"The resources of a WHOIS record for a given domain. This can include domain names, IP address blocks, autonomous system information, and/or contact and registration information for a domain.","properties":{"autonomous_system":{"$ref":"#/components/schemas/ocsfv1.4.0AutonomousSystem","nullable":true,"description":"The autonomous system information associated with a domain."},"created_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"When the domain was registered or WHOIS entry was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"When the domain was registered or WHOIS entry was created."},"dnssec_status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized value of dnssec_status_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"dnssec_status_id":{"$ref":"#/components/schemas/ocsfv1.4.0Whois_DnssecStatusId","nullable":true,"description":"Describes the normalized status of DNS Security Extensions (DNSSEC) for a domain."},"domain":{"type":"string","nullable":true,"description":"The domain name corresponding to the WHOIS record."},"domain_contacts":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.4.0DomainContact"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Domain Contact"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects."},"children":[],"type":"text"}],"type":"paragraph"}]},"email_addr":{"$ref":"#/components/schemas/ocsfv1.4.0EmailAddress","nullable":true,"description":"The email address for the registrar's abuse contact"},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.4.0Timestamp","nullable":true,"description":"When the WHOIS record was last updated or seen at."},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"When the WHOIS record was last updated or seen at."},"name_servers":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A collection of name servers related to a domain registration or other record."},"phone_number":{"type":"string","nullable":true,"description":"The phone number for the registrar's abuse contact"},"registrar":{"type":"string","nullable":true,"description":"The domain registrar."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The status of a domain and its ability to be transferred, e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"clientTransferProhibited"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"subdomains":{"type":"array","items":{"type":"string"},"nullable":true,"description":"An array of subdomain strings. Can be used to collect several subdomains such as those from Domain Generation Algorithms (DGAs)."},"subnet":{"$ref":"#/components/schemas/ocsfv1.4.0Subnet","nullable":true,"description":"The IP address block (CIDR) associated with a domain."}}}},"components/schemas/ocsfv1.4.0Whois_DnssecStatusId":{"id":"components/schemas/ocsfv1.4.0Whois_DnssecStatusId","kind":"json-schema","title":"ocsfv1.4.0Whois_DnssecStatusId","data":{"title":"ocsfv1.4.0Whois_DnssecStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"WhoisDnssecStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Signed: The related domain enables the signing of DNS records using DNSSEC."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Unsigned: The related domain does not enable the signing of DNS records using DNSSEC."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The DNSSEC status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dnssec_status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0EmailAddress":{"id":"components/schemas/ocsfv1.6.0EmailAddress","kind":"json-schema","title":"ocsfv1.6.0EmailAddress","data":{"title":"ocsfv1.6.0EmailAddress","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Email address. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"john_doe@example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0FileName":{"id":"components/schemas/ocsfv1.6.0FileName","kind":"json-schema","title":"ocsfv1.6.0FileName","data":{"title":"ocsfv1.6.0FileName","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"File name. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"text-file.txt"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0FilePath":{"id":"components/schemas/ocsfv1.6.0FilePath","kind":"json-schema","title":"ocsfv1.6.0FilePath","data":{"title":"ocsfv1.6.0FilePath","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full path to the file. For example: For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"c:\\windows\\system32\\svchost.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Hash":{"id":"components/schemas/ocsfv1.6.0Hash","kind":"json-schema","title":"ocsfv1.6.0Hash","data":{"title":"ocsfv1.6.0Hash","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Hash. A unique value that corresponds to the content of the file, image, ja3_hash or hassh found in the schema. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" MD5: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3172ac7e2b55cbb81f04a6e65855a628"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Hostname":{"id":"components/schemas/ocsfv1.6.0Hostname","kind":"json-schema","title":"ocsfv1.6.0Hostname","data":{"title":"ocsfv1.6.0Hostname","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Unique name assigned to a device connected to a computer network. It may be a fully qualified domain name (FQDN). For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"r2-d2.example.com."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":","},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mx.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0IPAddress":{"id":"components/schemas/ocsfv1.6.0IPAddress","kind":"json-schema","title":"ocsfv1.6.0IPAddress","data":{"title":"ocsfv1.6.0IPAddress","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Internet Protocol address (IP address), in either IPv4 or IPv6 format. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"192.168.200.24"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2001:0db8:85a3:0000:0000:8a2e:0370:7334"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0MACAddress":{"id":"components/schemas/ocsfv1.6.0MACAddress","kind":"json-schema","title":"ocsfv1.6.0MACAddress","data":{"title":"ocsfv1.6.0MACAddress","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Media Access Control (MAC) address. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"18:36:F3:98:4F:9A"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Port":{"id":"components/schemas/ocsfv1.6.0Port","kind":"json-schema","title":"ocsfv1.6.0Port","data":{"title":"ocsfv1.6.0Port","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The TCP/UDP port number. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"80"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":","},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"22"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0ProcessName":{"id":"components/schemas/ocsfv1.6.0ProcessName","kind":"json-schema","title":"ocsfv1.6.0ProcessName","data":{"title":"ocsfv1.6.0ProcessName","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Process name. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notepad"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Subnet":{"id":"components/schemas/ocsfv1.6.0Subnet","kind":"json-schema","title":"ocsfv1.6.0Subnet","data":{"title":"ocsfv1.6.0Subnet","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The subnet represented in a CIDR notation, using the format network_address/prefix_length. The network_address can be in either IPv4 or IPv6 format. The prefix length indicates the number of bits used for the network portion, and the remaining bits are available for host addresses within that subnet. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"192.168.1.0/24"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":","},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2001:0db8:85a3:0000::/64"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Timestamp":{"id":"components/schemas/ocsfv1.6.0Timestamp","kind":"json-schema","title":"ocsfv1.6.0Timestamp","data":{"title":"ocsfv1.6.0Timestamp","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1618524549901"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0URLString":{"id":"components/schemas/ocsfv1.6.0URLString","kind":"json-schema","title":"ocsfv1.6.0URLString","data":{"title":"ocsfv1.6.0URLString","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Uniform Resource Locator (URL) string. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http://www.example.com/download/trouble.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0UserName":{"id":"components/schemas/ocsfv1.6.0UserName","kind":"json-schema","title":"ocsfv1.6.0UserName","data":{"title":"ocsfv1.6.0UserName","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User name. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"john_doe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0emailactivityActionId":{"id":"components/schemas/ocsfv1.6.0emailactivityActionId","kind":"json-schema","title":"ocsfv1.6.0emailactivityActionId","data":{"title":"ocsfv1.6.0emailactivityActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Observed: The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Modified: The activity was modified, adjusted, or corrected. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0emailactivityActivityId":{"id":"components/schemas/ocsfv1.6.0emailactivityActivityId","kind":"json-schema","title":"ocsfv1.6.0emailactivityActivityId","data":{"title":"ocsfv1.6.0emailactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Send"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Receive"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Scan: Email being scanned (example: security scanning)"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Trace: Follow an email message as it travels through an organization. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message_trace_uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" should be populated when selected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - MTARelay: Email processed by an MTA, typically combining send, receive, and scan operations into a single activity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0emailactivityCategoryUid":{"id":"components/schemas/ocsfv1.6.0emailactivityCategoryUid","kind":"json-schema","title":"ocsfv1.6.0emailactivityCategoryUid","data":{"title":"ocsfv1.6.0emailactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n4 - NetworkActivity: Network Activity events."}},"components/schemas/ocsfv1.6.0emailactivityClassUid":{"id":"components/schemas/ocsfv1.6.0emailactivityClassUid","kind":"json-schema","title":"ocsfv1.6.0emailactivityClassUid","data":{"title":"ocsfv1.6.0emailactivityClassUid","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ClassUid is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4009 - EmailActivity: Email Activity events report SMTP protocol and email activities including those with embedded URLs and files. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Email"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object for details."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0emailactivityConfidenceId":{"id":"components/schemas/ocsfv1.6.0emailactivityConfidenceId","kind":"json-schema","title":"ocsfv1.6.0emailactivityConfidenceId","data":{"title":"ocsfv1.6.0emailactivityConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0emailactivityDirectionId":{"id":"components/schemas/ocsfv1.6.0emailactivityDirectionId","kind":"json-schema","title":"ocsfv1.6.0emailactivityDirectionId","data":{"title":"ocsfv1.6.0emailactivityDirectionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DirectionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The email direction is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Inbound: Email Inbound, from the Internet or outside network destined for an entity inside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Outbound: Email Outbound, from inside the network destined for an entity outside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Internal: Email Internal, from inside the network destined for an entity inside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The direction is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"direction"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0emailactivityDispositionId":{"id":"components/schemas/ocsfv1.6.0emailactivityDispositionId","kind":"json-schema","title":"ocsfv1.6.0emailactivityDispositionId","data":{"title":"ocsfv1.6.0emailactivityDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0emailactivityEmailActivity":{"id":"components/schemas/ocsfv1.6.0emailactivityEmailActivity","kind":"json-schema","title":"ocsfv1.6.0emailactivityEmailActivity","data":{"title":"ocsfv1.6.0emailactivityEmailActivity","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Email Activity events report SMTP protocol and email activities including those with embedded URLs and files. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Email"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object for details."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.6.0emailactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.6.0emailactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.6.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign."},"api":{"$ref":"#/components/schemas/ocsfv1.6.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"attempt":{"type":"integer","nullable":true,"description":"The attempt number for attempting to deliver the email."},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"banner":{"type":"string","nullable":true,"description":"The initial connection response that a messaging server receives after it connects to an email server."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Network Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.6.0emailactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.6.0emailactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.6.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"command":{"type":"string","nullable":true,"description":"The command issued by the initiator (client), such as SMTP HELO or EHLO."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.6.0emailactivityConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.6.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.6.0Device","nullable":true,"description":"An addressable device, computer system or host."},"direction":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The direction of the email, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"direction_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value."},"children":[],"type":"text"}],"type":"paragraph"}]},"direction_id":{"$ref":"#/components/schemas/ocsfv1.6.0emailactivityDirectionId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The direction of the email relative to the scanning host or organization."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"Email scanned at an internet gateway might be characterized as inbound to the organization from the Internet, outbound from the organization to the Internet, or internal within the organization. Email scanned at a workstation might be characterized as inbound to, or outbound from the workstation."},"children":[],"type":"text"}]},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.6.0emailactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkEndpoint","nullable":true,"description":"The responder (server) receiving the email."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"email":{"$ref":"#/components/schemas/ocsfv1.6.0Email","description":"The email object."},"email_auth":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAuth","nullable":true,"description":"The SPF, DKIM and DMARC attributes of an email."},"end_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.6.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"from":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress","nullable":true,"description":"The sender address from the transmission envelope. This reflects the actual sending party and may differ from the 'From' header in the message."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.6.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"message_trace_uid":{"type":"string","nullable":true,"description":"The identifier that tracks a message that travels through multiple points of a messaging service."},"metadata":{"$ref":"#/components/schemas/ocsfv1.6.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"policy":{"$ref":"#/components/schemas/ocsfv1.6.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"protocol_name":{"type":"string","nullable":true,"description":"The Protocol Name specifies the email communication protocol, such as SMTP, IMAP, or POP3."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.6.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.6.0emailactivityRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.6.0emailactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"smtp_hello":{"type":"string","nullable":true,"description":"The value of the SMTP HELO or EHLO command sent by the initiator (client)."},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkEndpoint","nullable":true,"description":"The initiator (client) sending the email."},"start_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.6.0emailactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"to":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress"},"nullable":true,"description":"The recipient address from the transmission envelope. This may differ from the 'To' header and represents where the message was actually delivered."},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.6.0emailactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.6.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","direction_id","email","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.6.0emailactivityRiskLevelId":{"id":"components/schemas/ocsfv1.6.0emailactivityRiskLevelId","kind":"json-schema","title":"ocsfv1.6.0emailactivityRiskLevelId","data":{"title":"ocsfv1.6.0emailactivityRiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0emailactivitySeverityId":{"id":"components/schemas/ocsfv1.6.0emailactivitySeverityId","kind":"json-schema","title":"ocsfv1.6.0emailactivitySeverityId","data":{"title":"ocsfv1.6.0emailactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0emailactivityStatusId":{"id":"components/schemas/ocsfv1.6.0emailactivityStatusId","kind":"json-schema","title":"ocsfv1.6.0emailactivityStatusId","data":{"title":"ocsfv1.6.0emailactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0emailactivityTypeUid":{"id":"components/schemas/ocsfv1.6.0emailactivityTypeUid","kind":"json-schema","title":"ocsfv1.6.0emailactivityTypeUid","data":{"title":"ocsfv1.6.0emailactivityTypeUid","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TypeUid is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400900 - Unknown"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400901 - Send"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400902 - Receive"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400903 - Scan: Email being scanned (example: security scanning)"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400904 - Trace: Follow an email message as it travels through an organization. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message_trace_uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" should be populated when selected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400905 - MTARelay: Email processed by an MTA, typically combining send, receive, and scan operations into a single activity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400999 - Other"},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0filehostingactivityActionId":{"id":"components/schemas/ocsfv1.6.0filehostingactivityActionId","kind":"json-schema","title":"ocsfv1.6.0filehostingactivityActionId","data":{"title":"ocsfv1.6.0filehostingactivityActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Observed: The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Modified: The activity was modified, adjusted, or corrected. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0filehostingactivityActivityId":{"id":"components/schemas/ocsfv1.6.0filehostingactivityActivityId","kind":"json-schema","title":"ocsfv1.6.0filehostingactivityActivityId","data":{"title":"ocsfv1.6.0filehostingactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Upload: Upload a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Download: Download a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Update: Update a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Delete: Delete a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Rename: Rename a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Copy: Copy a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Move: Move a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Restore: Restore a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Preview: Preview a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Lock: Lock a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Unlock: Unlock a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - Share: Share a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Unshare: Unshare a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Open: Open a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Sync: Mark a file or folder to sync with a computer."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - Unsync: Mark a file or folder to not sync with a computer."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - AccessCheck: Access check for a file. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile can be used to add the access check results."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0filehostingactivityCategoryUid":{"id":"components/schemas/ocsfv1.6.0filehostingactivityCategoryUid","kind":"json-schema","title":"ocsfv1.6.0filehostingactivityCategoryUid","data":{"title":"ocsfv1.6.0filehostingactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n6 - ApplicationActivity: Application Activity events report detailed information about the behavior of applications and services."}},"components/schemas/ocsfv1.6.0filehostingactivityClassUid":{"id":"components/schemas/ocsfv1.6.0filehostingactivityClassUid","kind":"json-schema","title":"ocsfv1.6.0filehostingactivityClassUid","data":{"title":"ocsfv1.6.0filehostingactivityClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n6006 - FileHostingActivity: File Hosting Activity events report the actions taken by file management applications, including file sharing servers like Sharepoint and services such as Box, MS OneDrive, Google Drive, or network file share services."}},"components/schemas/ocsfv1.6.0filehostingactivityConfidenceId":{"id":"components/schemas/ocsfv1.6.0filehostingactivityConfidenceId","kind":"json-schema","title":"ocsfv1.6.0filehostingactivityConfidenceId","data":{"title":"ocsfv1.6.0filehostingactivityConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0filehostingactivityDispositionId":{"id":"components/schemas/ocsfv1.6.0filehostingactivityDispositionId","kind":"json-schema","title":"ocsfv1.6.0filehostingactivityDispositionId","data":{"title":"ocsfv1.6.0filehostingactivityDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0filehostingactivityFileHosting":{"id":"components/schemas/ocsfv1.6.0filehostingactivityFileHosting","kind":"json-schema","title":"ocsfv1.6.0filehostingactivityFileHosting","data":{"title":"ocsfv1.6.0filehostingactivityFileHosting","type":"object","description":"File Hosting Activity events report the actions taken by file management applications, including file sharing servers like Sharepoint and services such as Box, MS OneDrive, Google Drive, or network file share services.","properties":{"access_list":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of requested access rights."},"access_mask":{"type":"integer","nullable":true,"description":"The sum of hexadecimal values of requested access rights."},"access_result":{"nullable":true,"description":"The list of access check results."},"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.6.0filehostingactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.6.0filehostingactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.6.0Actor","nullable":true,"description":"The actor that performed the activity on the target file."},"api":{"$ref":"#/components/schemas/ocsfv1.6.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Application Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.6.0filehostingactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.6.0filehostingactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.6.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.6.0filehostingactivityConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"connection_info":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkConnectionInfo","nullable":true,"description":"The network connection information."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.6.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.6.0Device","nullable":true,"description":"An addressable device, computer system or host."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.6.0filehostingactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkEndpoint","nullable":true,"description":"The endpoint that received the activity on the target file."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"expiration_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The share expiration time."},"expiration_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The share expiration time."},"file":{"$ref":"#/components/schemas/ocsfv1.6.0File","description":"The file that is the target of the activity."},"file_result":{"$ref":"#/components/schemas/ocsfv1.6.0File","nullable":true,"description":"The resulting file object when the activity was allowed and successful."},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.6.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"http_request":{"$ref":"#/components/schemas/ocsfv1.6.0HttpRequest","nullable":true,"description":"Details about the underlying HTTP request."},"http_response":{"$ref":"#/components/schemas/ocsfv1.6.0HttpResponse","nullable":true,"description":"Details about the HTTP response, if available."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.6.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.6.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"policy":{"$ref":"#/components/schemas/ocsfv1.6.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.6.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.6.0filehostingactivityRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.6.0filehostingactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"share":{"type":"string","nullable":true,"description":"The share name."},"share_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The share type, normalized to the caption of the share_type_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"share_type_id":{"$ref":"#/components/schemas/ocsfv1.6.0filehostingactivityShareTypeId","nullable":true,"description":"The normalized identifier of the share type."},"sharing":{"$ref":"#/components/schemas/ocsfv1.6.0Sharing","nullable":true,"description":"Information about how and with whom a resource was shared, such as sharing permissions and scope."},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkEndpoint","description":"The endpoint that performed the activity on the target file."},"start_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.6.0filehostingactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.6.0filehostingactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.6.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","file","metadata","severity_id","src_endpoint","time","type_uid"]}},"components/schemas/ocsfv1.6.0filehostingactivityRiskLevelId":{"id":"components/schemas/ocsfv1.6.0filehostingactivityRiskLevelId","kind":"json-schema","title":"ocsfv1.6.0filehostingactivityRiskLevelId","data":{"title":"ocsfv1.6.0filehostingactivityRiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0filehostingactivitySeverityId":{"id":"components/schemas/ocsfv1.6.0filehostingactivitySeverityId","kind":"json-schema","title":"ocsfv1.6.0filehostingactivitySeverityId","data":{"title":"ocsfv1.6.0filehostingactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0filehostingactivityShareTypeId":{"id":"components/schemas/ocsfv1.6.0filehostingactivityShareTypeId","kind":"json-schema","title":"ocsfv1.6.0filehostingactivityShareTypeId","data":{"title":"ocsfv1.6.0filehostingactivityShareTypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ShareTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The share type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - File"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Pipe"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Print"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The share type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"share_type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0filehostingactivityStatusId":{"id":"components/schemas/ocsfv1.6.0filehostingactivityStatusId","kind":"json-schema","title":"ocsfv1.6.0filehostingactivityStatusId","data":{"title":"ocsfv1.6.0filehostingactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0filehostingactivityTypeUid":{"id":"components/schemas/ocsfv1.6.0filehostingactivityTypeUid","kind":"json-schema","title":"ocsfv1.6.0filehostingactivityTypeUid","data":{"title":"ocsfv1.6.0filehostingactivityTypeUid","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TypeUid is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600600 - Unknown"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600601 - Upload: Upload a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600602 - Download: Download a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600603 - Update: Update a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600604 - Delete: Delete a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600605 - Rename: Rename a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600606 - Copy: Copy a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600607 - Move: Move a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600608 - Restore: Restore a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600609 - Preview: Preview a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600610 - Lock: Lock a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600611 - Unlock: Unlock a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600612 - Share: Share a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600613 - Unshare: Unshare a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600614 - Open: Open a file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600615 - Sync: Mark a file or folder to sync with a computer."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600616 - Unsync: Mark a file or folder to not sync with a computer."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600617 - AccessCheck: Access check for a file. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile can be used to add the access check results."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"600699 - Other"},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0httpactivityActionId":{"id":"components/schemas/ocsfv1.6.0httpactivityActionId","kind":"json-schema","title":"ocsfv1.6.0httpactivityActionId","data":{"title":"ocsfv1.6.0httpactivityActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Observed: The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Modified: The activity was modified, adjusted, or corrected. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0httpactivityActivityId":{"id":"components/schemas/ocsfv1.6.0httpactivityActivityId","kind":"json-schema","title":"ocsfv1.6.0httpactivityActivityId","data":{"title":"ocsfv1.6.0httpactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Connect: The CONNECT method establishes a tunnel to the server identified by the target resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Delete: The DELETE method deletes the specified resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Get: The GET method requests a representation of the specified resource. Requests using GET should only retrieve data."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Head: The HEAD method asks for a response identical to a GET request, but without the response body."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Options: The OPTIONS method describes the communication options for the target resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Post: The POST method submits an entity to the specified resource, often causing a change in state or side effects on the server."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Put: The PUT method replaces all current representations of the target resource with the request payload."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Trace: The TRACE method performs a message loop-back test along the path to the target resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Patch: The PATCH method applies partial modifications to a resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0httpactivityCategoryUid":{"id":"components/schemas/ocsfv1.6.0httpactivityCategoryUid","kind":"json-schema","title":"ocsfv1.6.0httpactivityCategoryUid","data":{"title":"ocsfv1.6.0httpactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n4 - NetworkActivity: Network Activity events."}},"components/schemas/ocsfv1.6.0httpactivityClassUid":{"id":"components/schemas/ocsfv1.6.0httpactivityClassUid","kind":"json-schema","title":"ocsfv1.6.0httpactivityClassUid","data":{"title":"ocsfv1.6.0httpactivityClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n4002 - HTTPActivity: HTTP Activity events report HTTP connection and traffic information."}},"components/schemas/ocsfv1.6.0httpactivityConfidenceId":{"id":"components/schemas/ocsfv1.6.0httpactivityConfidenceId","kind":"json-schema","title":"ocsfv1.6.0httpactivityConfidenceId","data":{"title":"ocsfv1.6.0httpactivityConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0httpactivityDispositionId":{"id":"components/schemas/ocsfv1.6.0httpactivityDispositionId","kind":"json-schema","title":"ocsfv1.6.0httpactivityDispositionId","data":{"title":"ocsfv1.6.0httpactivityDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0httpactivityHttpActivity":{"id":"components/schemas/ocsfv1.6.0httpactivityHttpActivity","kind":"json-schema","title":"ocsfv1.6.0httpactivityHttpActivity","data":{"title":"ocsfv1.6.0httpactivityHttpActivity","type":"object","description":"HTTP Activity events report HTTP connection and traffic information.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.6.0httpactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.6.0httpactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.6.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign."},"api":{"$ref":"#/components/schemas/ocsfv1.6.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"app_name":{"type":"string","nullable":true,"description":"The name of the application associated with the event or object."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Network Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.6.0httpactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.6.0httpactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.6.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.6.0httpactivityConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"connection_info":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkConnectionInfo","nullable":true,"description":"The network connection information."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.6.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.6.0Device","nullable":true,"description":"An addressable device, computer system or host."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.6.0httpactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkEndpoint","nullable":true,"description":"The responder (server) in a network connection."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"file":{"$ref":"#/components/schemas/ocsfv1.6.0File","nullable":true,"description":"The file that is the target of the HTTP activity."},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.6.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"http_cookies":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0HttpCookie"},"nullable":true,"description":"The cookies object describes details about HTTP cookies"},"http_request":{"$ref":"#/components/schemas/ocsfv1.6.0HttpRequest","nullable":true,"description":"The HTTP Request Object documents attributes of a request made to a web server."},"http_response":{"$ref":"#/components/schemas/ocsfv1.6.0HttpResponse","nullable":true,"description":"The HTTP Response from a web server to a requester."},"http_status":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Hypertext Transfer Protocol (HTTP) "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status code"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" returned to the client."},"children":[],"type":"text"}],"type":"paragraph"}]},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"ja4_fingerprint_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Ja4Fingerprint"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of the JA4+ network fingerprints."},"children":[],"type":"text"}],"type":"paragraph"}]},"load_balancer":{"$ref":"#/components/schemas/ocsfv1.6.0LoadBalancer","nullable":true,"description":"The Load Balancer object contains information related to the device that is distributing incoming traffic to specified destinations."},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.6.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.6.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"policy":{"$ref":"#/components/schemas/ocsfv1.6.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"proxy":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkProxy","nullable":true,"description":"The proxy (server) in a network connection."},"proxy_connection_info":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkConnectionInfo","nullable":true,"description":"The connection information from the proxy server to the remote server."},"proxy_endpoint":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkProxy","nullable":true,"description":"The proxy (server) in a network connection."},"proxy_http_request":{"$ref":"#/components/schemas/ocsfv1.6.0HttpRequest","nullable":true,"description":"The HTTP Request from the proxy server to the remote server."},"proxy_http_response":{"$ref":"#/components/schemas/ocsfv1.6.0HttpResponse","nullable":true,"description":"The HTTP Response from the remote server to the proxy server."},"proxy_tls":{"$ref":"#/components/schemas/ocsfv1.6.0Tls","nullable":true,"description":"The TLS protocol negotiated between the proxy server and the remote server."},"proxy_traffic":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkTraffic","nullable":true,"description":"The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.6.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.6.0httpactivityRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.6.0httpactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkEndpoint","nullable":true,"description":"The initiator (client) of the network connection."},"start_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.6.0httpactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"tls":{"$ref":"#/components/schemas/ocsfv1.6.0Tls","nullable":true,"description":"The Transport Layer Security (TLS) attributes."},"traffic":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkTraffic","nullable":true,"description":"The network traffic refers to the amount of data moving across a network at a given point of time. Intended to be used alongside Network Connection."},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.6.0httpactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.6.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.6.0httpactivityRiskLevelId":{"id":"components/schemas/ocsfv1.6.0httpactivityRiskLevelId","kind":"json-schema","title":"ocsfv1.6.0httpactivityRiskLevelId","data":{"title":"ocsfv1.6.0httpactivityRiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0httpactivitySeverityId":{"id":"components/schemas/ocsfv1.6.0httpactivitySeverityId","kind":"json-schema","title":"ocsfv1.6.0httpactivitySeverityId","data":{"title":"ocsfv1.6.0httpactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0httpactivityStatusId":{"id":"components/schemas/ocsfv1.6.0httpactivityStatusId","kind":"json-schema","title":"ocsfv1.6.0httpactivityStatusId","data":{"title":"ocsfv1.6.0httpactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0httpactivityTypeUid":{"id":"components/schemas/ocsfv1.6.0httpactivityTypeUid","kind":"json-schema","title":"ocsfv1.6.0httpactivityTypeUid","data":{"title":"ocsfv1.6.0httpactivityTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n400200 - Unknown\n400201 - Connect: The CONNECT method establishes a tunnel to the server identified by the target resource.\n400202 - Delete: The DELETE method deletes the specified resource.\n400203 - Get: The GET method requests a representation of the specified resource. Requests using GET should only retrieve data.\n400204 - Head: The HEAD method asks for a response identical to a GET request, but without the response body.\n400205 - Options: The OPTIONS method describes the communication options for the target resource.\n400206 - Post: The POST method submits an entity to the specified resource, often causing a change in state or side effects on the server.\n400207 - Put: The PUT method replaces all current representations of the target resource with the request payload.\n400208 - Trace: The TRACE method performs a message loop-back test along the path to the target resource.\n400209 - Patch: The PATCH method applies partial modifications to a resource.\n400299 - Other"}},"components/schemas/ocsfv1.6.0Account":{"id":"components/schemas/ocsfv1.6.0Account","kind":"json-schema","title":"ocsfv1.6.0Account","data":{"title":"ocsfv1.6.0Account","type":"object","description":"The Account object contains details about the account that initiated or performed a specific activity within a system or application. Additionally, the Account object refers to logical Cloud and Software-as-a-Service (SaaS) based containers such as AWS Accounts, Azure Subscriptions, Oracle Cloud Compartments, Google Cloud Projects, and otherwise.","properties":{"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels associated to the account."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the account (e.g. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" GCP Project name "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Linux Account name "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" AWS Account name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}]},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the account."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0Account_TypeId","nullable":true,"description":"The normalized account type identifier."},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the account (e.g. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" AWS Account ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" OCID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" GCP Project ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Azure Subscription ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Google Workspace Customer ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" M365 Tenant UID"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.6.0Account_TypeId":{"id":"components/schemas/ocsfv1.6.0Account_TypeId","kind":"json-schema","title":"ocsfv1.6.0Account_TypeId","data":{"title":"ocsfv1.6.0Account_TypeId","type":"integer","description":"AccountTypeId is an enum, and the following values are allowed.\n0 - Unknown: The account type is unknown.\n1 - LDAPAccount\n2 - WindowsAccount\n3 - AWSIAMUser\n4 - AWSIAMRole\n5 - GCPAccount\n6 - AzureADAccount\n7 - MacOSAccount\n8 - AppleAccount\n9 - LinuxAccount\n10 - AWSAccount\n11 - GCPProject\n12 - OCICompartment\n13 - AzureSubscription\n14 - SalesforceAccount\n15 - GoogleWorkspace\n16 - ServicenowInstance\n17 - M365Tenant\n18 - EmailAccount\n99 - Other: The account type is not mapped."}},"components/schemas/ocsfv1.6.0Actor":{"id":"components/schemas/ocsfv1.6.0Actor","kind":"json-schema","title":"ocsfv1.6.0Actor","data":{"title":"ocsfv1.6.0Actor","type":"object","description":"The Actor object contains details about the user, role, application, service, or process that initiated or performed a specific activity. Note that Actor is not the threat actor of a campaign but may be part of a campaign.","properties":{"actor_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The actor type, normalized to the caption of the actor_type_id value. In the case of 'Other', it is defined by the data source."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor_type_id":{"$ref":"#/components/schemas/ocsfv1.6.0Actor_ActorTypeId","nullable":true,"description":"The normalized identifier of the actor type."},"app_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The client application or service that initiated the activity. This can be in conjunction with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"user"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present.  Note that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"app_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is distinct from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"process"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present."},"children":[],"type":"text"}],"type":"paragraph"}]},"app_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the client application or service that initiated the activity. This can be in conjunction with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"user"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present. Note that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"app_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is distinct from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"process.pid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"process.uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Group"},"nullable":true,"description":"Groups which are pertinent to the action. For example, the team name for Teams, where the user may not necessarily be a member of the group, but it is still relevant to the action taken."},"idp":{"$ref":"#/components/schemas/ocsfv1.6.0Idp","nullable":true,"description":"This object describes details about the Identity Provider used."},"invoked_by":{"type":"string","nullable":true,"description":"The name of the service that invoked the activity as described in the event."},"process":{"$ref":"#/components/schemas/ocsfv1.6.0Process","nullable":true,"description":"The process that initiated the activity."},"session":{"$ref":"#/components/schemas/ocsfv1.6.0Session","nullable":true,"description":"The user session from which the activity was initiated."},"user":{"$ref":"#/components/schemas/ocsfv1.6.0User","nullable":true,"description":"The user that initiated the activity or the user context from which the activity was initiated."}}}},"components/schemas/ocsfv1.6.0Actor_ActorTypeId":{"id":"components/schemas/ocsfv1.6.0Actor_ActorTypeId","kind":"json-schema","title":"ocsfv1.6.0Actor_ActorTypeId","data":{"title":"ocsfv1.6.0Actor_ActorTypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActorActorTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The actor type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Internal: Internal actor."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Guest: Guest actor."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Federated: Federated actor."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The actor type is not mapped. See the actor_type attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Advisory":{"id":"components/schemas/ocsfv1.6.0Advisory","kind":"json-schema","title":"ocsfv1.6.0Advisory","data":{"title":"ocsfv1.6.0Advisory","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Advisory object represents publicly disclosed cybersecurity vulnerabilities defined in a Security advisory. e.g. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Microsoft KB Article, Apple Security Advisory"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"avg_timespan":{"$ref":"#/components/schemas/ocsfv1.6.0Timespan","nullable":true,"description":"The average time to patch."},"bulletin":{"type":"string","nullable":true,"description":"The Advisory bulletin identifier."},"classification":{"type":"string","nullable":true,"description":"The vendors classification of the Advisory."},"created_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the Advisory record was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the Advisory record was created."},"desc":{"type":"string","nullable":true,"description":"A brief description of the Advisory Record."},"install_state":{"type":"string","nullable":true,"description":"The install state of the Advisory."},"install_state_id":{"$ref":"#/components/schemas/ocsfv1.6.0Advisory_InstallStateId","nullable":true,"description":"The normalized install state ID of the Advisory."},"is_superseded":{"type":"boolean","nullable":true,"description":"The Advisory has been replaced by another."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the Advisory record was last updated."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the Advisory record was last updated."},"os":{"$ref":"#/components/schemas/ocsfv1.6.0Os","nullable":true,"description":"The operating system the Advisory applies to."},"product":{"$ref":"#/components/schemas/ocsfv1.6.0Product","nullable":true,"description":"The product where the vulnerability was discovered."},"references":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of reference URLs with additional information about the vulnerabilities disclosed in the Advisory."},"related_cves":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Cve"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of Common Vulnerabilities and Exposures "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cve.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"(CVE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" identifiers related to the vulnerabilities disclosed in the Advisory."},"children":[],"type":"text"}],"type":"paragraph"}]},"related_cwes":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Cwe"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of Common Weakness Enumeration "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"(CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" identifiers related to the vulnerabilities disclosed in the Advisory."},"children":[],"type":"text"}],"type":"paragraph"}]},"size":{"type":"integer","nullable":true,"description":"The size in bytes for the Advisory. Usually populated for a KB Article patch."},"src_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":"The Advisory link from the source vendor."},"title":{"type":"string","nullable":true,"description":"A title or a brief phrase summarizing the Advisory."},"uid":{"type":"string","description":"The unique number assigned to the disclosed vulnerability."}},"required":["uid"]}},"components/schemas/ocsfv1.6.0Advisory_InstallStateId":{"id":"components/schemas/ocsfv1.6.0Advisory_InstallStateId","kind":"json-schema","title":"ocsfv1.6.0Advisory_InstallStateId","data":{"title":"ocsfv1.6.0Advisory_InstallStateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AdvisoryInstallStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized install state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Installed: The item is installed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - NotInstalled: The item is not installed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - InstalledPendingReboot: The item is installed pending reboot operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The install state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"install_state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0AffectedCode":{"id":"components/schemas/ocsfv1.6.0AffectedCode","kind":"json-schema","title":"ocsfv1.6.0AffectedCode","data":{"title":"ocsfv1.6.0AffectedCode","type":"object","description":"The Affected Code object describes details about a code block identified as vulnerable.","properties":{"end_column":{"type":"integer","nullable":true,"description":"The column number of the last part of the assessed code identified as vulnerable."},"end_line":{"type":"integer","nullable":true,"description":"The line number of the last line of code block identified as vulnerable."},"file":{"$ref":"#/components/schemas/ocsfv1.6.0File","description":"Details about the file that contains the affected code block."},"owner":{"$ref":"#/components/schemas/ocsfv1.6.0User","nullable":true,"description":"Details about the user that owns the affected file."},"remediation":{"$ref":"#/components/schemas/ocsfv1.6.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"rule":{"$ref":"#/components/schemas/ocsfv1.6.0Rule","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Details about the specific rule, e.g., those defined as part of a larger "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"policy"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", that triggered the finding."},"children":[],"type":"text"}],"type":"paragraph"}]},"start_column":{"type":"integer","nullable":true,"description":"The column number of the first part of the assessed code identified as vulnerable."},"start_line":{"type":"integer","nullable":true,"description":"The line number of the first line of code block identified as vulnerable."}},"required":["file"]}},"components/schemas/ocsfv1.6.0AffectedPackage":{"id":"components/schemas/ocsfv1.6.0AffectedPackage","kind":"json-schema","title":"ocsfv1.6.0AffectedPackage","data":{"title":"ocsfv1.6.0AffectedPackage","type":"object","description":"The Affected Package object describes details about a software package identified as affected by a vulnerability/vulnerabilities.","properties":{"architecture":{"type":"string","nullable":true,"description":"Architecture is a shorthand name describing the type of computer hardware the packaged software is meant to run on."},"cpe_name":{"type":"string","nullable":true,"description":"The Common Platform Enumeration (CPE) name for the software package."},"epoch":{"type":"integer","nullable":true,"description":"The software package epoch. Epoch is a way to define weighted dependencies based on version numbers."},"fixed_in_version":{"type":"string","nullable":true,"description":"The software package version in which a reported vulnerability was patched/fixed."},"hash":{"$ref":"#/components/schemas/ocsfv1.6.0Fingerprint","nullable":true,"description":"Cryptographic hash to identify the binary instance of a software component. This can include any component such file, package, or library."},"license":{"type":"string","nullable":true,"description":"The software license applied to this package."},"license_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL pointing to the license applied on package or software. This is typically a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LICENSE.md"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" file within a repository."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","description":"The software package name."},"package_manager":{"type":"string","nullable":true,"description":"The software packager manager utilized to manage a package on a system, e.g. npm, yum, dpkg etc."},"package_manager_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL of the package or library at the package manager, or the specific URL or URI of an internal package manager link such as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AWS CodeArtifact"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Artifactory"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"path":{"$ref":"#/components/schemas/ocsfv1.6.0FilePath","nullable":true,"description":"The installation path of the affected package."},"purl":{"type":"string","nullable":true,"description":"A purl is a URL string used to identify and locate a software package in a mostly universal and uniform way across programming languages, package managers, packaging conventions, tools, APIs and databases."},"release":{"type":"string","nullable":true,"description":"Release is the number of times a version of the software has been packaged."},"remediation":{"$ref":"#/components/schemas/ocsfv1.6.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"src_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The link to the specific library or package such as within "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"GitHub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", this is different from the link to the package manager where the library or package is hosted."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of software package, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0AffectedPackage_TypeId","nullable":true,"description":"The type of software package."},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A unique identifier for the package or library reported by the source tool. E.g., the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"libId"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" within the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"sbom"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field of an OX Security Issue or the SPDX "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"components.*.bom-ref"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor who published the software package."},"version":{"type":"string","description":"The software package version."}},"required":["name","version"]}},"components/schemas/ocsfv1.6.0AffectedPackage_TypeId":{"id":"components/schemas/ocsfv1.6.0AffectedPackage_TypeId","kind":"json-schema","title":"ocsfv1.6.0AffectedPackage_TypeId","data":{"title":"ocsfv1.6.0AffectedPackage_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AffectedPackageTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Application: An application software package."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - OperatingSystem: An operating system software package."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Agent":{"id":"components/schemas/ocsfv1.6.0Agent","kind":"json-schema","title":"ocsfv1.6.0Agent","data":{"title":"ocsfv1.6.0Agent","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An Agent (also known as a Sensor) is typically installed on an Operating System (OS) and serves as a specialized software component that can be designed to monitor, detect, collect, archive, or take action. These activities and possible actions are defined by the upstream system controlling the Agent and its intended purpose. For instance, an Agent can include Endpoint Detection & Response (EDR) agents, backup/disaster recovery sensors, Application Performance Monitoring or profiling sensors, and similar software."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the agent or sensor. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AWS SSM Agent"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"policies":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Policy"},"nullable":true,"description":"Describes the various policies that may be applied or enforced by an agent or sensor. E.g., Conditional Access, prevention, auto-update, tamper protection, destination configuration, etc."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of the type_id value for the agent or sensor. In the case of 'Other' or 'Unknown', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0Agent_TypeId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized representation of an agent or sensor. E.g., EDR, vulnerability management, APM, backup & recovery, etc."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The UID of the agent or sensor, sometimes known as a Sensor ID or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"aid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid_alt":{"type":"string","nullable":true,"description":"An alternative or contextual identifier for the agent or sensor, such as a configuration, organization, or license UID."},"vendor_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The company or author who created the agent or sensor. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Crowdstrike"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The semantic version of the agent or sensor, e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"7.101.50.0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.6.0Agent_TypeId":{"id":"components/schemas/ocsfv1.6.0Agent_TypeId","kind":"json-schema","title":"ocsfv1.6.0Agent_TypeId","data":{"title":"ocsfv1.6.0Agent_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AgentTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool that provides similar threat detection, anti-malware, anti-ransomware, or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender for Endpoint, Wazuh."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that provides similar data classification, data loss detection, and/or data loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview, Symantec DLP."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Recovery: Any agent or sensor that provides backups, archival, or recovery capabilities. E.g., Azure Backup, AWS Backint Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Observability: Any agent or sensor that provides Application Performance Monitoring (APM), active tracing, profiling, or other observability use cases and optionally forwards the logs. E.g., New Relic Agent, Datadog Agent, Azure Monitor Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - VulnerabilityManagement: Any agent or sensor that provides vulnerability management or scanning capabilities. E.g., Qualys VMDR, Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party storage system such as a data lake or SIEM. E.g., Splunk Universal Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - MobileDeviceManagement: Any agent or sensor responsible for providing Mobile Device Management (MDM) or Mobile Enterprise Management (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - ConfigurationManagement: Any agent or sensor that provides configuration management of a device, such as scanning for software, license management, or applying configurations. E.g., AWS Systems Manager Agent, Flexera, ServiceNow MID Server."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - RemoteAccess: Any agent or sensor that provides remote access capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager Agent, Verkada Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Analytic":{"id":"components/schemas/ocsfv1.6.0Analytic","kind":"json-schema","title":"ocsfv1.6.0Analytic","data":{"title":"ocsfv1.6.0Analytic","type":"object","description":"The Analytic object contains details about the analytic technique used to analyze and derive insights from the data or information that led to the creation of a finding or conclusion.","properties":{"algorithm":{"type":"string","nullable":true,"description":"The algorithm used by the underlying analytic to generate the finding."},"category":{"type":"string","nullable":true,"description":"The analytic category."},"desc":{"type":"string","nullable":true,"description":"The description of the analytic that generated the finding."},"name":{"type":"string","nullable":true,"description":"The name of the analytic that generated the finding."},"related_analytics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Object"},"nullable":true,"description":"Other analytics related to this analytic."},"state":{"type":"string","nullable":true,"description":"The Analytic state."},"state_id":{"$ref":"#/components/schemas/ocsfv1.6.0Analytic_StateId","nullable":true,"description":"The Analytic state identifier."},"type":{"type":"string","nullable":true,"description":"The analytic type."},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0Analytic_TypeId","description":"The analytic type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the analytic that generated the finding."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The analytic version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["type_id"]}},"components/schemas/ocsfv1.6.0Analytic_StateId":{"id":"components/schemas/ocsfv1.6.0Analytic_StateId","kind":"json-schema","title":"ocsfv1.6.0Analytic_StateId","data":{"title":"ocsfv1.6.0Analytic_StateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AnalyticStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Active: The Analytic is active."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Suppressed: The Analytic is suppressed. For example, a user/customer has suppressed a particular detection signature in a security product."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Experimental: The Analytic is still under development and considered experimental."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Analytic_TypeId":{"id":"components/schemas/ocsfv1.6.0Analytic_TypeId","kind":"json-schema","title":"ocsfv1.6.0Analytic_TypeId","data":{"title":"ocsfv1.6.0Analytic_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AnalyticTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Rule: A Rule in security analytics refers to predefined criteria or conditions set to monitor, alert, or enforce policies, playing a crucial role in access control, threat detection, and regulatory compliance across security systems."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Behavioral: Behavioral analytics focus on monitoring and analyzing user or system actions to identify deviations from established patterns, aiding in the detection of insider threats, fraud, and advanced persistent threats (APTs)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Statistical: Statistical analytics pertains to analyzing data patterns and anomalies using statistical models to predict, detect, and respond to potential threats, enhancing overall security posture through informed decision-making."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - ML_DL_: Learning (ML/DL) encompasses techniques that can \"learn\" from known data to create analytics that generalize to new data. There may be a statistical component to these techniques, but it is not a requirement."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Fingerprinting: Fingerprinting is the technique of collecting detailed system data, including software versions and configurations, to enhance threat detection, data loss prevention (DLP), and endpoint detection and response (EDR) capabilities."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Tagging: Tagging refers to the practice of assigning labels or identifiers to data, users, assets, or activities to monitor, control access, and facilitate incident response across various security domains such as DLP and EDR."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - KeywordMatch: Keyword Match involves scanning content for specific terms to identify sensitive information, potential threats, or policy violations, aiding in DLP and compliance monitoring."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - RegularExpressions: Regular Expressions are used to define complex search patterns for identifying, validating, and extracting specific data sets or threats within digital content, enhancing DLP, EDR, and threat detection mechanisms."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - ExactDataMatch: Exact Data Match is a precise comparison technique used to detect the unauthorized use or exposure of specific, sensitive information, crucial for enforcing DLP policies and protecting against data breaches."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - PartialDataMatch: Partial Data Match involves identifying instances where segments of sensitive information or patterns match, facilitating nuanced DLP and threat detection without requiring complete data conformity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - IndexedDataMatch: Indexed Data Match refers to comparing content against a pre-compiled index of sensitive information to efficiently detect and prevent unauthorized access or breaches, streamlining DLP and compliance efforts."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Api":{"id":"components/schemas/ocsfv1.6.0Api","kind":"json-schema","title":"ocsfv1.6.0Api","data":{"title":"ocsfv1.6.0Api","type":"object","description":"The API, or Application Programming Interface, object represents  information pertaining to an API request and response.","properties":{"group":{"$ref":"#/components/schemas/ocsfv1.6.0Group","nullable":true,"description":"The information pertaining to the API group."},"operation":{"type":"string","description":"Verb/Operation associated with the request"},"request":{"$ref":"#/components/schemas/ocsfv1.6.0Request","nullable":true,"description":"Details pertaining to the API request."},"response":{"$ref":"#/components/schemas/ocsfv1.6.0Response","nullable":true,"description":"Details pertaining to the API response."},"service":{"$ref":"#/components/schemas/ocsfv1.6.0Service","nullable":true,"description":"The information pertaining to the API service."},"version":{"type":"string","nullable":true,"description":"The version of the API service."}},"required":["operation"]}},"components/schemas/ocsfv1.6.0Attack":{"id":"components/schemas/ocsfv1.6.0Attack","kind":"json-schema","title":"ocsfv1.6.0Attack","data":{"title":"ocsfv1.6.0Attack","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE ATT&CK® & ATLAS™ object describes the tactic, technique, sub-technique & mitigation associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"mitigation":{"$ref":"#/components/schemas/ocsfv1.6.0Mitigation","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Mitigation object describes the MITRE ATT&CK® or ATLAS™ Mitigation ID and/or name that is associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}]},"sub_technique":{"$ref":"#/components/schemas/ocsfv1.6.0SubTechnique","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Sub-technique object describes the MITRE ATT&CK® or ATLAS™ Sub-technique ID and/or name associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}]},"tactic":{"$ref":"#/components/schemas/ocsfv1.6.0Tactic","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Tactic object describes the MITRE ATT&CK® or ATLAS™ Tactic ID and/or name that is associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}]},"tactics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Tactic"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Tactic object describes the tactic ID and/or tactic name that are associated with the attack technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"technique":{"$ref":"#/components/schemas/ocsfv1.6.0Technique","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Technique object describes the MITRE ATT&CK® or ATLAS™ Technique ID and/or name associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The ATT&CK® or ATLAS™ Matrix version."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.6.0AuthFactor":{"id":"components/schemas/ocsfv1.6.0AuthFactor","kind":"json-schema","title":"ocsfv1.6.0AuthFactor","data":{"title":"ocsfv1.6.0AuthFactor","type":"object","description":"An Authentication Factor object describes a category of methods used for identity verification in an authentication attempt.","properties":{"device":{"$ref":"#/components/schemas/ocsfv1.6.0Device","nullable":true,"description":"Device used to complete an authentication request."},"email_addr":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress","nullable":true,"description":"The email address used in an email-based authentication factor."},"factor_type":{"type":"string","nullable":true,"description":"The type of authentication factor used in an authentication attempt."},"factor_type_id":{"$ref":"#/components/schemas/ocsfv1.6.0AuthFactor_FactorTypeId","description":"The normalized identifier for the authentication factor."},"is_hotp":{"type":"boolean","nullable":true,"description":"Whether the authentication factor is an HMAC-based One-time Password (HOTP)."},"is_totp":{"type":"boolean","nullable":true,"description":"Whether the authentication factor is a Time-based One-time Password (TOTP)."},"phone_number":{"type":"string","nullable":true,"description":"The phone number used for a telephony-based authentication request."},"provider":{"type":"string","nullable":true,"description":"The name of provider for an authentication factor."},"security_questions":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The question(s) provided to user for a question-based authentication factor."}},"required":["factor_type_id"]}},"components/schemas/ocsfv1.6.0AuthFactor_FactorTypeId":{"id":"components/schemas/ocsfv1.6.0AuthFactor_FactorTypeId","kind":"json-schema","title":"ocsfv1.6.0AuthFactor_FactorTypeId","data":{"title":"ocsfv1.6.0AuthFactor_FactorTypeId","type":"integer","description":"AuthFactorFactorTypeId is an enum, and the following values are allowed.\n0 - Unknown\n1 - SMS: User receives and inputs a code sent to their mobile device via SMS text message.\n2 - SecurityQuestion: The user responds to a security question as part of a question-based authentication factor\n3 - PhoneCall: System calls the user's registered phone number and requires the user to answer and provide a response.\n4 - Biometric: Devices that verify identity-based on user's physical identifiers, such as fingerprint scanners or retina scanners.\n5 - PushNotification: Push notification is sent to user's registered device and requires the user to acknowledge.\n6 - HardwareToken: Physical device that generates a code to be used for authentication.\n7 - OTP: Application generates a one-time password (OTP) for use in authentication.\n8 - Email: A code or link is sent to a user's registered email address.\n9 - U2F: Typically involves a hardware token, which the user physically interacts with to authenticate.\n10 - WebAuthn: Web-based API that enables users to register devices as authentication factors.\n11 - Password: The user enters a password that they have previously established.\n99 - Other"}},"components/schemas/ocsfv1.6.0Authorization":{"id":"components/schemas/ocsfv1.6.0Authorization","kind":"json-schema","title":"ocsfv1.6.0Authorization","data":{"title":"ocsfv1.6.0Authorization","type":"object","description":"The Authorization Result object provides details about the authorization outcome and associated policies related to activity.","properties":{"decision":{"type":"string","nullable":true,"description":"Authorization Result/outcome, e.g. allowed, denied."},"policy":{"$ref":"#/components/schemas/ocsfv1.6.0Policy","nullable":true,"description":"Details about the Identity/Access management policies that are applicable."}}}},"components/schemas/ocsfv1.6.0AutonomousSystem":{"id":"components/schemas/ocsfv1.6.0AutonomousSystem","kind":"json-schema","title":"ocsfv1.6.0AutonomousSystem","data":{"title":"ocsfv1.6.0AutonomousSystem","type":"object","description":"An autonomous system (AS) is a collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators on behalf of a single administrative entity or domain that presents a common, clearly defined routing policy to the internet.","properties":{"name":{"type":"string","nullable":true,"description":"Organization name for the Autonomous System."},"number":{"type":"integer","nullable":true,"description":"Unique number that the AS is identified by."}}}},"components/schemas/ocsfv1.6.0Campaign":{"id":"components/schemas/ocsfv1.6.0Campaign","kind":"json-schema","title":"ocsfv1.6.0Campaign","data":{"title":"ocsfv1.6.0Campaign","type":"object","description":"Campaign represent organized efforts by threat actors to achieve malicious objectives over a period, often characterized by shared tactics, techniques, and procedures (TTPs).","properties":{"name":{"type":"string","description":"The name of a specific campaign associated with a cyber threat."}},"required":["name"]}},"components/schemas/ocsfv1.6.0Certificate":{"id":"components/schemas/ocsfv1.6.0Certificate","kind":"json-schema","title":"ocsfv1.6.0Certificate","data":{"title":"ocsfv1.6.0Certificate","type":"object","description":"The Digital Certificate, also known as a Public Key Certificate, object contains information about the ownership and usage of a public key. It serves as a means to establish trust in the authenticity and integrity of the public key and the associated entity.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the certificate was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the certificate was created."},"expiration_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The expiration time of the certificate."},"expiration_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The expiration time of the certificate."},"fingerprints":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Fingerprint"},"nullable":true,"description":"The fingerprint list of the certificate."},"is_self_signed":{"type":"boolean","nullable":true,"description":"Denotes whether a digital certificate is self-signed or signed by a known certificate authority (CA)."},"issuer":{"type":"string","description":"The certificate issuer distinguished name."},"sans":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0San"},"nullable":true,"description":"The list of subject alternative names that are secured by a specific certificate."},"serial_number":{"type":"string","description":"The serial number of the certificate used to create the digital signature."},"subject":{"type":"string","nullable":true,"description":"The certificate subject distinguished name."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the certificate."},"version":{"type":"string","nullable":true,"description":"The certificate version."}},"required":["issuer","serial_number"]}},"components/schemas/ocsfv1.6.0CisControl":{"id":"components/schemas/ocsfv1.6.0CisControl","kind":"json-schema","title":"ocsfv1.6.0CisControl","data":{"title":"ocsfv1.6.0CisControl","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CIS Control (aka Critical Security Control) object describes a prioritized set of actions to protect your organization and data from cyber-attack vectors. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.cisecurity.org/controls"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CIS Controls"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" are defined by the Center for Internet Security."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"desc":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CIS Control description. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"i","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"name":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CIS Control name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"i","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CIS Control version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"i","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"v8"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["name"]}},"components/schemas/ocsfv1.6.0Cloud":{"id":"components/schemas/ocsfv1.6.0Cloud","kind":"json-schema","title":"ocsfv1.6.0Cloud","data":{"title":"ocsfv1.6.0Cloud","type":"object","description":"The Cloud object contains information about a cloud or Software-as-a-Service account or similar construct, such as AWS Account ID, regions, organizations, folders, compartments, tenants, etc.","properties":{"account":{"$ref":"#/components/schemas/ocsfv1.6.0Account","nullable":true,"description":"The account object describes details about the account that was the source or target of the activity."},"cloud_partition":{"type":"string","nullable":true,"description":"The canonical cloud partition name to which the region is assigned (e.g. AWS Partitions: aws, aws-cn, aws-us-gov)."},"org":{"$ref":"#/components/schemas/ocsfv1.6.0Organization","nullable":true,"description":"Organization and org unit relevant to the event or object."},"project_uid":{"type":"string","nullable":true,"description":"The unique identifier of a Cloud project."},"provider":{"type":"string","description":"The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc."},"region":{"type":"string","nullable":true,"description":"The name of the cloud region, as defined by the cloud provider."},"zone":{"type":"string","nullable":true,"description":"The availability zone in the cloud region, as defined by the cloud provider."}},"required":["provider"]}},"components/schemas/ocsfv1.6.0Container":{"id":"components/schemas/ocsfv1.6.0Container","kind":"json-schema","title":"ocsfv1.6.0Container","data":{"title":"ocsfv1.6.0Container","type":"object","description":"The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.","properties":{"hash":{"$ref":"#/components/schemas/ocsfv1.6.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Commit hash of image created for docker or the SHA256 hash of the container. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"image":{"$ref":"#/components/schemas/ocsfv1.6.0Image","nullable":true,"description":"The container image used as a template to run the container."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels associated to the container."},"name":{"type":"string","nullable":true,"description":"The container name."},"network_driver":{"type":"string","nullable":true,"description":"The network driver used by the container. For example, bridge, overlay, host, none, etc."},"orchestrator":{"type":"string","nullable":true,"description":"The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift."},"pod_uuid":{"type":"string","nullable":true,"description":"The unique identifier of the pod (or equivalent) that the container is executing on."},"runtime":{"type":"string","nullable":true,"description":"The backend running the container, such as containerd or cri-o."},"size":{"type":"integer","nullable":true,"description":"The size of the container image."},"tag":{"type":"string","nullable":true,"description":"The tag used by the container. It can indicate version, format, OS."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the container."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full container unique identifier for this instantiation of the container. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.6.0Cve":{"id":"components/schemas/ocsfv1.6.0Cve","kind":"json-schema","title":"ocsfv1.6.0Cve","data":{"title":"ocsfv1.6.0Cve","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Vulnerabilities and Exposures (CVE) object represents publicly disclosed cybersecurity vulnerabilities defined in CVE Program catalog ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cve.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVE"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"). There is one CVE Record for each vulnerability in the catalog."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE."},"cvss":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Cvss"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS object details Common Vulnerability Scoring System ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/cvss/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") scores from the advisory that are related to the vulnerability."},"children":[],"type":"text"}],"type":"paragraph"}]},"cwe":{"$ref":"#/components/schemas/ocsfv1.6.0Cwe","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CWE object represents a weakness in a software system that can be exploited by a threat actor to perform an attack. The CWE object is based on the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Common Weakness Enumeration (CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" catalog."},"children":[],"type":"text"}],"type":"paragraph"}]},"cwe_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Common Weakness Enumeration (CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" unique identifier. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CWE-787"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cwe_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Common Weakness Enumeration (CWE) definition URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://cwe.mitre.org/data/definitions/787.html"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"desc":{"type":"string","nullable":true,"description":"A brief description of the CVE Record."},"epss":{"$ref":"#/components/schemas/ocsfv1.6.0Epss","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Exploit Prediction Scoring System (EPSS) object describes the estimated probability a vulnerability will be exploited. EPSS is a community-driven effort to combine descriptive information about vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild. ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/epss/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"EPSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}]},"modified_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The Record Modified Date identifies when the CVE record was last updated."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The Record Modified Date identifies when the CVE record was last updated."},"product":{"$ref":"#/components/schemas/ocsfv1.6.0Product","nullable":true,"description":"The product where the vulnerability was discovered."},"references":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of reference URLs with additional information about the CVE Record."},"related_cwes":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Cwe"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the Common Weakness Enumeration "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"(CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" details related to the CVE Record."},"children":[],"type":"text"}],"type":"paragraph"}]},"title":{"type":"string","nullable":true,"description":"A title or a brief phrase summarizing the CVE record."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The vulnerability type as selected from a large dropdown menu during CVE refinement."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"Most frequently used vulnerability types are: "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"DoS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Code Execution"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Overflow"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Memory Corruption"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Sql Injection"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"XSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Directory Traversal"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Http Response Splitting"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Bypass something"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Gain Information"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Gain Privileges"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"CSRF"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"File Inclusion"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":". For more information see "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.cvedetails.com/vulnerabilities-by-types.php"}},"children":[{"$$mdtype":"Node","attributes":{"content":"Vulnerabilities By Type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" distributions."},"children":[],"type":"text"}]},"uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Vulnerabilities and Exposures unique number assigned to a specific computer vulnerability. A CVE Identifier begins with 4 digits representing the year followed by a sequence of digits that acts as a unique identifier. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVE-2021-12345"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["uid"]}},"components/schemas/ocsfv1.6.0Cvss":{"id":"components/schemas/ocsfv1.6.0Cvss","kind":"json-schema","title":"ocsfv1.6.0Cvss","data":{"title":"ocsfv1.6.0Cvss","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Vulnerability Scoring System ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/cvss/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") object provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"base_score":{"type":"number","format":"double","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS base score. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"9.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"depth":{"$ref":"#/components/schemas/ocsfv1.6.0Cvss_Depth","nullable":true,"description":"The CVSS depth represents a depth of the equation used to calculate CVSS score."},"metrics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Metric"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Vulnerability Scoring System metrics. This attribute contains information on the CVE's impact. If the CVE has been analyzed, this attribute will contain any CVSSv2 or CVSSv3 information associated with the vulnerability. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{ {\"Access Vector\", \"Network\"}, {\"Access Complexity\", \"Low\"}, ...}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"overall_score":{"type":"number","format":"double","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS overall score, impacted by base, temporal, and environmental metrics. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"9.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"CVSS v2.0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Low (0.0 – 3.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Medium (4.0 – 6.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"High (7.0 – 10.0)"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"CVSS v3.0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"None (0.0)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Low (0.1 - 3.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Medium (4.0 - 6.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"High (7.0 - 8.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Critical (9.0 - 10.0)"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The source URL for the CVSS score. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"vector_string":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"vendor_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The vendor that provided the CVSS score. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NVD, REDHAT"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" etc."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["base_score","version"]}},"components/schemas/ocsfv1.6.0Cvss_Depth":{"id":"components/schemas/ocsfv1.6.0Cvss_Depth","kind":"json-schema","title":"ocsfv1.6.0Cvss_Depth","data":{"title":"ocsfv1.6.0Cvss_Depth","type":"string","description":"CvssDepth is an enum, and the following values are allowed.\nBase - Base\nEnvironmental - Environmental\nTemporal - Temporal"}},"components/schemas/ocsfv1.6.0Cwe":{"id":"components/schemas/ocsfv1.6.0Cwe","kind":"json-schema","title":"ocsfv1.6.0Cwe","data":{"title":"ocsfv1.6.0Cwe","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CWE object represents a weakness in a software system that can be exploited by a threat actor to perform an attack. The CWE object is based on the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Common Weakness Enumeration (CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" catalog."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"caption":{"type":"string","nullable":true,"description":"The caption assigned to the Common Weakness Enumeration unique identifier."},"src_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"URL pointing to the CWE Specification. For more information see "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CWE."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Weakness Enumeration unique number assigned to a specific weakness. A CWE Identifier begins \"CWE\" followed by a sequence of digits that acts as a unique identifier. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CWE-123"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["uid"]}},"components/schemas/ocsfv1.6.0D3fTactic":{"id":"components/schemas/ocsfv1.6.0D3fTactic","kind":"json-schema","title":"ocsfv1.6.0D3fTactic","data":{"title":"ocsfv1.6.0D3fTactic","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE D3FEND™ Tactic object describes the tactic ID and/or name that is associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The tactic name that is associated with the defensive technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Isolate"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The versioned permalink of the defensive tactic. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://d3fend.mitre.org/tactic/d3f:Isolate/"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the defensive tactic."}}}},"components/schemas/ocsfv1.6.0D3fTechnique":{"id":"components/schemas/ocsfv1.6.0D3fTechnique","kind":"json-schema","title":"ocsfv1.6.0D3fTechnique","data":{"title":"ocsfv1.6.0D3fTechnique","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE D3FEND™ Technique object describes the leaf defensive technique ID and/or name associated to a countermeasure."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the defensive technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IO Port Restriction"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The versioned permalink of the defensive technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://d3fend.mitre.org/technique/d3f:IOPortRestriction/"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the defensive technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"D3-IOPR"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.6.0D3fend":{"id":"components/schemas/ocsfv1.6.0D3fend","kind":"json-schema","title":"ocsfv1.6.0D3fend","data":{"title":"ocsfv1.6.0D3fend","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE D3FEND™ object describes the tactic & technique associated with a countermeasure."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"d3f_tactic":{"$ref":"#/components/schemas/ocsfv1.6.0D3fTactic","nullable":true,"description":"The Tactic object describes the tactic ID and/or name that is associated with a countermeasure."},"d3f_technique":{"$ref":"#/components/schemas/ocsfv1.6.0D3fTechnique","nullable":true,"description":"The Technique object describes the technique ID and/or name associated with a countermeasure."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The D3FEND™ Matrix version."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.6.0Device":{"id":"components/schemas/ocsfv1.6.0Device","kind":"json-schema","title":"ocsfv1.6.0Device","data":{"title":"ocsfv1.6.0Device","type":"object","description":"The Device object represents an addressable computer system or host, which is typically connected to a computer network and participates in the transmission or processing of data within the computer network.","properties":{"agent_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Agent"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"agent"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects associated with a device, endpoint, or resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"autoscale_uid":{"type":"string","nullable":true,"description":"The unique identifier of the cloud autoscale configuration."},"boot_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time the system was booted."},"boot_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the system was booted."},"boot_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A unique identifier of the device that changes after every reboot. For example, the value of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"/proc/sys/kernel/random/boot_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from Linux's procfs."},"children":[],"type":"text"}],"type":"paragraph"}]},"container":{"$ref":"#/components/schemas/ocsfv1.6.0Container","nullable":true,"description":"The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd."},"created_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the device was known to have been created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the device was known to have been created."},"desc":{"type":"string","nullable":true,"description":"The description of the device, ordinarily as reported by the operating system."},"domain":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network domain where the device resides. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"work.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"eid":{"type":"string","nullable":true,"description":"An Embedded Identity Document, is a unique serial number that identifies an eSIM-enabled device."},"first_seen_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The initial discovery time of the device."},"first_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The initial discovery time of the device."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Group"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The group names to which the device belongs. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[\"Windows Laptops\", \"Engineering\"]"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"hostname":{"$ref":"#/components/schemas/ocsfv1.6.0Hostname","nullable":true,"description":"The device hostname."},"hw_info":{"$ref":"#/components/schemas/ocsfv1.6.0DeviceHwInfo","nullable":true,"description":"The endpoint hardware information."},"hypervisor":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the hypervisor running on the device. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Xen"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"VMware"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Hyper-V"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"VirtualBox"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", etc."},"children":[],"type":"text"}],"type":"paragraph"}]},"iccid":{"type":"string","nullable":true,"description":"The Integrated Circuit Card Identification of a mobile device. Typically it is a unique 18 to 22 digit number that identifies a SIM card."},"image":{"$ref":"#/components/schemas/ocsfv1.6.0Image","nullable":true,"description":"The image used as a template to run the virtual machine."},"imei":{"type":"string","nullable":true,"description":"The International Mobile Equipment Identity that is associated with the device."},"imei_list":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The International Mobile Equipment Identity values that are associated with the device."},"instance_uid":{"type":"string","nullable":true,"description":"The unique identifier of a VM instance."},"interface_name":{"type":"string","nullable":true,"description":"The name of the network interface (e.g. eth2)."},"interface_uid":{"type":"string","nullable":true,"description":"The unique identifier of the network interface."},"ip":{"$ref":"#/components/schemas/ocsfv1.6.0IPAddress","nullable":true,"description":"The device IP address, in either IPv4 or IPv6 format."},"ip_addresses":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of IP addresses available on the device"},"is_backed_up":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates whether the device or resource has a backup enabled, such as an automated snapshot or a cloud backup. For example, this is indicated by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cloudBackupEnabled"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value within JAMF Pro mobile devices or the registration of an AWS ARN with the AWS Backup service."},"children":[],"type":"text"}],"type":"paragraph"}]},"is_compliant":{"type":"boolean","nullable":true,"description":"The event occurred on a compliant device."},"is_managed":{"type":"boolean","nullable":true,"description":"The event occurred on a managed device."},"is_mobile_account_active":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates whether the device has an active mobile account. For example, this is indicated by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"itunesStoreAccountActive"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value within JAMF Pro mobile devices."},"children":[],"type":"text"}],"type":"paragraph"}]},"is_personal":{"type":"boolean","nullable":true,"description":"The event occurred on a personal device."},"is_shared":{"type":"boolean","nullable":true,"description":"The event occurred on a shared device."},"is_supervised":{"type":"boolean","nullable":true,"description":"The event occurred on a supervised device. Devices that are supervised are typically mobile devices managed by a Mobile Device Management solution and are restricted from specific behaviors such as Apple AirDrop."},"is_trusted":{"type":"boolean","nullable":true,"description":"The event occurred on a trusted device."},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The most recent discovery time of the device."},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent discovery time of the device."},"location":{"$ref":"#/components/schemas/ocsfv1.6.0Location","nullable":true,"description":"The geographical location of the device."},"mac":{"$ref":"#/components/schemas/ocsfv1.6.0MACAddress","nullable":true,"description":"The Media Access Control (MAC) address of the endpoint."},"mac_addresses":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of MAC addresses available on the device"},"meid":{"type":"string","nullable":true,"description":"The Mobile Equipment Identifier. It's a unique number that identifies a Code Division Multiple Access (CDMA) mobile device."},"model":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The model of the device. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MacBook Pro"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"t3a.medium"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"modified_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the device was last known to have been modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the device was last known to have been modified."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The alternate device name, ordinarily as assigned by an administrator. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" could be any other string that helps to identify the device, such as a phone number; for example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"310-555-1234"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"namespace_pid":{"type":"integer","nullable":true,"description":"If running under a process namespace (such as in a container), the process identifier within that process namespace."},"netbios_names":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of NetBIOS names available on the device"},"network_interfaces":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkInterface"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The physical or virtual network interfaces that are associated with the device, one for each unique MAC address/IP address/hostname/name combination."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" The first element of the array is the network information that pertains to the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"network_status":{"type":"string","nullable":true,"description":"The network isolation status of the endpoint"},"network_status_id":{"$ref":"#/components/schemas/ocsfv1.6.0Device_NetworkStatusId","nullable":true,"description":"The network isolation status ID."},"org":{"$ref":"#/components/schemas/ocsfv1.6.0Organization","nullable":true,"description":"Organization and org unit related to the device."},"os":{"$ref":"#/components/schemas/ocsfv1.6.0Os","nullable":true,"description":"The endpoint operating system."},"os_machine_uuid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The operating system assigned Machine ID. In Windows, this is the value stored at the registry path: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\MachineGuid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In Linux, this is stored in the file: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"/etc/machine-id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"owner":{"$ref":"#/components/schemas/ocsfv1.6.0User","nullable":true,"description":"The identity of the service or user account that owns the endpoint or was last logged into it."},"region":{"type":"string","nullable":true,"description":"The region where the virtual machine is located. For example, an AWS Region."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.6.0Device_RiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"src_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":"The URL of the device in the event sources system."},"subnet":{"$ref":"#/components/schemas/ocsfv1.6.0Subnet","nullable":true,"description":"The subnet mask."},"subnet_uid":{"type":"string","nullable":true,"description":"The unique identifier of a virtual subnet."},"sw_info":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Product"},"nullable":true,"description":"The list of software contained on a device"},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The device type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"unknown"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"plc"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"scada"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dcs"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cnc"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"scientific"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"medical"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"lighting"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"energy"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"transportation"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0Device_TypeId","description":"The device type ID."},"udid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Apple assigned Unique Device Identifier (UDID). For iOS, iPadOS, tvOS, watchOS and visionOS devices, this is the UDID. For macOS devices, it is the Provisioning UDID. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"00008020-008D4548007B4F26"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the device. For example the Windows TargetSID or AWS EC2 ARN."},"uid_alt":{"type":"string","nullable":true,"description":"An alternate unique identifier of the device if any. For example the ActiveDirectory DN."},"vendor":{"$ref":"#/components/schemas/ocsfv1.6.0Organization","nullable":true,"description":"The product vendor that created the device."},"vendor_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The vendor for the device. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Dell"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Lenovo"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"vlan_uid":{"type":"string","nullable":true,"description":"The Virtual LAN identifier."},"vpc_uid":{"type":"string","nullable":true,"description":"The unique identifier of the Virtual Private Cloud (VPC)."},"zone":{"type":"string","nullable":true,"description":"The network zone or LAN segment."}},"required":["type_id"]}},"components/schemas/ocsfv1.6.0Device_NetworkStatusId":{"id":"components/schemas/ocsfv1.6.0Device_NetworkStatusId","kind":"json-schema","title":"ocsfv1.6.0Device_NetworkStatusId","data":{"title":"ocsfv1.6.0Device_NetworkStatusId","type":"integer","description":"DeviceNetworkStatusId is an enum, and the following values are allowed.\n1 - NotIsolated: Device is not isolated from the network.\n2 - Isolated: Device is isolated from the network.\n3 - PendingIsolation: Device is pending isolation from the network.\n4 - PendingRestore: Device is pending restoration from isolation.\n99 - Unknown: The network isolation status is unknown."}},"components/schemas/ocsfv1.6.0Device_RiskLevelId":{"id":"components/schemas/ocsfv1.6.0Device_RiskLevelId","kind":"json-schema","title":"ocsfv1.6.0Device_RiskLevelId","data":{"title":"ocsfv1.6.0Device_RiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DeviceRiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Device_TypeId":{"id":"components/schemas/ocsfv1.6.0Device_TypeId","kind":"json-schema","title":"ocsfv1.6.0Device_TypeId","data":{"title":"ocsfv1.6.0Device_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DeviceTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Server: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Server/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Desktop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Laptop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Tablet: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Mobile: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile phone"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Virtual: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual machine"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - IOT: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.techtarget.com/iotagenda/definition/IoT-device"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IOT (Internet of Things) device"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Browser: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Browser/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"web browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Firewall: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Firewall/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking firewall"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Switch: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Switch/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking switch"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Hub: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Ethernet_hub"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking hub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - Router: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Router/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking router"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - IDS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion detection system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - IPS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion prevention system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - LoadBalancer: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Load_balancing_(computing)"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Load Balancer device."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"89 - ImagingEquipment: Equipment for processing optical data, such as a camera."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"90 - PLC: A Programmable logic controller."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"91 - SCADA: A supervisory control and data acquisition system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"92 - DCS: A distributed control system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"93 - CNC: A computer numerical control system, including computerized machine tools."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"94 - ScientificEquipment: A piece of scientific equipment such as an oscilloscope or spectrometer."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"95 - MedicalDevice: A medical device such as an MRI machine or infusion pump."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"96 - LightingControls: A lighting control for internal or external applications."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"97 - EnergyMonitoringSystem: An energy monitoring, security or safety system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"98 - TransportationDevice: A transportation device or transportation supporting device."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0DeviceHwInfo":{"id":"components/schemas/ocsfv1.6.0DeviceHwInfo","kind":"json-schema","title":"ocsfv1.6.0DeviceHwInfo","data":{"title":"ocsfv1.6.0DeviceHwInfo","type":"object","description":"The Device Hardware Information object contains details and specifications of the physical components that make up a device. This information provides an overview of the hardware capabilities, configuration, and characteristics of the device.","properties":{"bios_date":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The BIOS date. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"03/31/16"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"bios_manufacturer":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The BIOS manufacturer. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LENOVO"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"bios_uid":{"type":"string","nullable":true,"description":"The BIOS UUID."},"bios_ver":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The BIOS version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LENOVO G5ETA2WW (2.62)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"chassis":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The chassis type describes the system enclosure or physical form factor. Such as the following examples for Windows "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Windows Chassis Types"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"cpu_architecture":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CPU architecture, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpu_architecture_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_architecture_id":{"$ref":"#/components/schemas/ocsfv1.6.0DeviceHwInfo_CpuArchitectureId","nullable":true,"description":"The normalized identifier of the CPU architecture."},"cpu_bits":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cpu architecture, the number of bits used for addressing in memory. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"32"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"64"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_cores":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of processor cores in all installed processors. For Example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"42"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of physical processors on a system. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_speed":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The speed of the processor in Mhz. For Example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"4200"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The processor type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"x86 Family 6 Model 37 Stepping 5"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"desktop_display":{"$ref":"#/components/schemas/ocsfv1.6.0Display","nullable":true,"description":"The desktop display affiliated with the event"},"keyboard_info":{"$ref":"#/components/schemas/ocsfv1.6.0KeyboardInfo","nullable":true,"description":"The keyboard detailed information."},"ram_size":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The total amount of installed RAM, in Megabytes. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2048"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"serial_number":{"type":"string","nullable":true,"description":"The device manufacturer serial number."},"uuid":{"type":"string","nullable":true,"description":"The device manufacturer assigned universally unique hardware identifier. For example: The BIOS System UUID or the Apple IOPlatformUUID."},"vendor_name":{"type":"string","nullable":true,"description":"The device manufacturer."}}}},"components/schemas/ocsfv1.6.0DeviceHwInfo_CpuArchitectureId":{"id":"components/schemas/ocsfv1.6.0DeviceHwInfo_CpuArchitectureId","kind":"json-schema","title":"ocsfv1.6.0DeviceHwInfo_CpuArchitectureId","data":{"title":"ocsfv1.6.0DeviceHwInfo_CpuArchitectureId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DeviceHwInfoCpuArchitectureId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The CPU architecture is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - x86: CPU uses the x86 ISA. For bitness, refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpu_bits"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - ARM: CPU uses the ARM ISA. For bitness, refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpu_bits"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - V: CPU uses the RISC-V ISA. For bitness, refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpu_bits"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The CPU architecture is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpu_architecture"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0DigitalSignature":{"id":"components/schemas/ocsfv1.6.0DigitalSignature","kind":"json-schema","title":"ocsfv1.6.0DigitalSignature","data":{"title":"ocsfv1.6.0DigitalSignature","type":"object","description":"The Digital Signature object contains information about the cryptographic mechanism used to verify the authenticity, integrity, and origin of the file or application.","properties":{"algorithm":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The digital signature algorithm used to create the signature, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"algorithm_id":{"$ref":"#/components/schemas/ocsfv1.6.0DigitalSignature_AlgorithmId","description":"The identifier of the normalized digital signature algorithm."},"certificate":{"$ref":"#/components/schemas/ocsfv1.6.0Certificate","nullable":true,"description":"The certificate object containing information about the digital certificate."},"created_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the digital signature was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the digital signature was created."},"developer_uid":{"type":"string","nullable":true,"description":"The developer ID on the certificate that signed the file."},"digest":{"$ref":"#/components/schemas/ocsfv1.6.0Fingerprint","nullable":true,"description":"The message digest attribute contains the fixed length message hash representation and the corresponding hashing algorithm information."},"state":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The digital signature state defines the signature state, normalized to the caption of 'state_id'. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"state_id":{"$ref":"#/components/schemas/ocsfv1.6.0DigitalSignature_StateId","nullable":true,"description":"The normalized identifier of the signature state."}},"required":["algorithm_id"]}},"components/schemas/ocsfv1.6.0DigitalSignature_AlgorithmId":{"id":"components/schemas/ocsfv1.6.0DigitalSignature_AlgorithmId","kind":"json-schema","title":"ocsfv1.6.0DigitalSignature_AlgorithmId","data":{"title":"ocsfv1.6.0DigitalSignature_AlgorithmId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DigitalSignatureAlgorithmId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The algorithm is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - DSA: Digital Signature Algorithm (DSA)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - ECDSA: Elliptic Curve Digital Signature Algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The algorithm is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"algorithm"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0DigitalSignature_StateId":{"id":"components/schemas/ocsfv1.6.0DigitalSignature_StateId","kind":"json-schema","title":"ocsfv1.6.0DigitalSignature_StateId","data":{"title":"ocsfv1.6.0DigitalSignature_StateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DigitalSignatureStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Valid: The digital signature is valid."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Expired: The digital signature is not valid due to expiration of certificate."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Revoked: The digital signature is invalid due to certificate revocation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Suspended: The digital signature is invalid due to certificate suspension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Pending: The digital signature state is pending."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Display":{"id":"components/schemas/ocsfv1.6.0Display","kind":"json-schema","title":"ocsfv1.6.0Display","data":{"title":"ocsfv1.6.0Display","type":"object","description":"The Display object contains information about the physical or virtual display connected to a computer system.","properties":{"color_depth":{"type":"integer","nullable":true,"description":"The numeric color depth."},"physical_height":{"type":"integer","nullable":true,"description":"The numeric physical height of display."},"physical_orientation":{"type":"integer","nullable":true,"description":"The numeric physical orientation of display."},"physical_width":{"type":"integer","nullable":true,"description":"The numeric physical width of display."},"scale_factor":{"type":"integer","nullable":true,"description":"The numeric scale factor of display."}}}},"components/schemas/ocsfv1.6.0DnsAnswer":{"id":"components/schemas/ocsfv1.6.0DnsAnswer","kind":"json-schema","title":"ocsfv1.6.0DnsAnswer","data":{"title":"ocsfv1.6.0DnsAnswer","type":"object","description":"The DNS Answer object represents a specific response provided by the Domain Name System (DNS) when querying for information about a domain or performing a DNS operation. It encapsulates the relevant details and data returned by the DNS server in response to a query.","properties":{"class":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The class of DNS data contained in this resource record. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.rfc-editor.org/rfc/rfc1035.txt"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC1035"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IN"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"flag_ids":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0DnsAnswer_FlagIds"},"nullable":true,"description":"The list of DNS answer header flag IDs."},"flags":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of DNS answer header flags."},"packet_uid":{"type":"integer","nullable":true,"description":"The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response."},"rdata":{"type":"string","description":"The data describing the DNS resource. The meaning of this data depends on the type and class of the resource record."},"ttl":{"type":"integer","nullable":true,"description":"The time interval that the resource record may be cached. Zero value means that the resource record can only be used for the transaction in progress, and should not be cached."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of data contained in this resource record. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.rfc-editor.org/rfc/rfc1035.txt"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC1035"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CNAME"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["rdata"]}},"components/schemas/ocsfv1.6.0DnsAnswer_FlagIds":{"id":"components/schemas/ocsfv1.6.0DnsAnswer_FlagIds","kind":"json-schema","title":"ocsfv1.6.0DnsAnswer_FlagIds","data":{"title":"ocsfv1.6.0DnsAnswer_FlagIds","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DnsAnswerFlagIds is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The flag is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - AuthoritativeAnswer"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - TruncatedResponse"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - RecursionDesired"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - RecursionAvailable"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - AuthenticData"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - CheckingDisabled"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The flag is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"flags"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0DomainContact":{"id":"components/schemas/ocsfv1.6.0DomainContact","kind":"json-schema","title":"ocsfv1.6.0DomainContact","data":{"title":"ocsfv1.6.0DomainContact","type":"object","description":"The contact information related to a domain registration, e.g., registrant, administrator, abuse, billing, or technical contact.","properties":{"email_addr":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress","nullable":true,"description":"The user's primary email address."},"location":{"$ref":"#/components/schemas/ocsfv1.6.0Location","nullable":true,"description":"Location details for the contract such as the city, state/province, country, etc."},"name":{"type":"string","nullable":true,"description":"The individual or organization name for the contact."},"phone_number":{"type":"string","nullable":true,"description":"The number associated with the phone."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Domain Contact type, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source"},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0DomainContact_TypeId","description":"The normalized domain contact type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the contact information, typically provided in WHOIS information."}},"required":["type_id"]}},"components/schemas/ocsfv1.6.0DomainContact_TypeId":{"id":"components/schemas/ocsfv1.6.0DomainContact_TypeId","kind":"json-schema","title":"ocsfv1.6.0DomainContact_TypeId","data":{"title":"ocsfv1.6.0DomainContact_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DomainContactTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Registrant: The contact information provided is for the domain registrant."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Administrative: The contact information provided is for the domain administrator."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Technical: The contact information provided is for the domain technical lead."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Billing: The contact information provided is for the domain billing lead."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Abuse: The contact information provided is for the domain abuse contact."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Email":{"id":"components/schemas/ocsfv1.6.0Email","kind":"json-schema","title":"ocsfv1.6.0Email","data":{"title":"ocsfv1.6.0Email","type":"object","description":"The Email object describes the email metadata such as sender, recipients, and direction, and can include embedded URLs and files.","properties":{"bcc":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The BCC recipients of the email. Similar to cc field but for BCC recipients."},"cc":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable email header Cc values, as defined by RFC 5322. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cc_mailboxes":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-readable email header Cc Mailbox values. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"'Example User <example.user@usersdomain.com>'"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"delivered_to":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Delivered-To"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" email header field. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"delivered_to_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Delivered-To"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" email header values. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"files":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0File"},"nullable":true,"description":"The files embedded or attached to the email."},"from":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable email header From value, as defined by RFC 5322. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"from_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable email header From values. This array should contain the value in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"from"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"from_mailbox":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-readable email header From Mailbox value. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"'Example User <example.user@usersdomain.com>'"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"from_mailboxes":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-readable email header From Mailbox values. This array should contain the value in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"from_mailbox"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"'Example User <example.user@usersdomain.com>'"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"http_headers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0HttpHeader"},"nullable":true,"description":"Additional HTTP headers of an HTTP request or response."},"is_externally_viewable":{"type":"boolean","nullable":true,"description":"True if the email is viewable externally (presumably by external users)."},"is_read":{"type":"boolean","nullable":true,"description":"The indication of whether the email has been read."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Labels associated with the object, such as security or sensitivity labels created by a scanning app."},"message_uid":{"type":"string","nullable":true,"description":"The email header Message-ID value, as defined by RFC 5322."},"raw_header":{"type":"string","nullable":true,"description":"The email authentication header."},"reply_to":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable email header Reply-To value, as defined by RFC 5322. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"reply_to_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable email header Reply-To values, as defined by RFC 5322. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"reply_to_mailboxes":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-readable email header Reply To Mailbox values. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"'Example User <example.user@usersdomain.com>'"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"return_path":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The address found in the 'Return-Path' header, which indicates where bounce messages (non-delivery reports) should be sent. This address is often set by the sending system and may differ from the 'From' or 'Sender' addresses. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mailer-daemon@senderserver.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"sender":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine readable email address of the system or server that actually transmitted the email message, extracted from the email headers per RFC 5322. This differs from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"from"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field, which shows the message author. The sender field is most commonly used when multiple addresses appear in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" from_list "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field, or when the transmitting system is different from the message author (such as when sending on behalf of someone else)."},"children":[],"type":"text"}],"type":"paragraph"}]},"sender_mailbox":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human readable email address of the system or server that actually transmitted the email message, extracted from the email headers per RFC 5322. This differs from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"from_mailbox"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field, which shows the message author. The sender mailbox field is most commonly used when multiple addresses appear in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" from_mailboxes "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field, or when the transmitting system is different from the message author (such as when sending on behalf of someone else)."},"children":[],"type":"text"}],"type":"paragraph"}]},"sender_mailbox_uid":{"type":"string","nullable":true,"description":"Unique ID of the sender mailbox. This is distinct from the sender's email address."},"size":{"type":"integer","nullable":true,"description":"The size in bytes of the email, including attachments."},"smtp_from":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress","nullable":true,"description":"The value of the SMTP MAIL FROM command."},"smtp_to":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress"},"nullable":true,"description":"The value of the SMTP envelope RCPT TO command."},"subject":{"type":"string","nullable":true,"description":"The email header Subject value, as defined by RFC 5322."},"time_sent":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time at which the email was sent."},"time_sent_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time at which the email was sent."},"to":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable email header To values, as defined by RFC 5322. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"to_mailboxes":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-readable email header To Mailbox values. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"'Example User <example.user@usersdomain.com>'"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the email thread."},"urls":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The URLs embedded in the email."},"x_originating_ip":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0IPAddress"},"nullable":true,"description":"The X-Originating-IP header identifying the emails originating IP address(es)."}}}},"components/schemas/ocsfv1.6.0EmailAuth":{"id":"components/schemas/ocsfv1.6.0EmailAuth","kind":"json-schema","title":"ocsfv1.6.0EmailAuth","data":{"title":"ocsfv1.6.0EmailAuth","type":"object","description":"The Email Authentication object describes the Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC) attributes of an email.","properties":{"dkim":{"type":"string","nullable":true,"description":"The DomainKeys Identified Mail (DKIM) status of the email."},"dkim_domain":{"type":"string","nullable":true,"description":"The DomainKeys Identified Mail (DKIM) signing domain of the email."},"dkim_signature":{"type":"string","nullable":true,"description":"The DomainKeys Identified Mail (DKIM) signature used by the sending/receiving system."},"dmarc":{"type":"string","nullable":true,"description":"The Domain-based Message Authentication, Reporting and Conformance (DMARC) status of the email."},"dmarc_override":{"type":"string","nullable":true,"description":"The Domain-based Message Authentication, Reporting and Conformance (DMARC) override action."},"dmarc_policy":{"type":"string","nullable":true,"description":"The Domain-based Message Authentication, Reporting and Conformance (DMARC) policy status."},"spf":{"type":"string","nullable":true,"description":"The Sender Policy Framework (SPF) status of the email."}}}},"components/schemas/ocsfv1.6.0EncryptionDetails":{"id":"components/schemas/ocsfv1.6.0EncryptionDetails","kind":"json-schema","title":"ocsfv1.6.0EncryptionDetails","data":{"title":"ocsfv1.6.0EncryptionDetails","type":"object","description":"Details about the encryption methodology utilized.","properties":{"algorithm":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The encryption algorithm used, normalized to the caption of 'algorithm_id"},"children":[],"type":"text"}],"type":"paragraph"}]},"algorithm_id":{"$ref":"#/components/schemas/ocsfv1.6.0EncryptionDetails_AlgorithmId","nullable":true,"description":"The encryption algorithm used."},"key_length":{"type":"integer","nullable":true,"description":"The length of the encryption key used."},"key_uid":{"type":"string","nullable":true,"description":"The unique identifier of the key used for encryption. For example, AWS KMS Key ARN."},"type":{"type":"string","nullable":true,"description":"The type of the encryption used."}}}},"components/schemas/ocsfv1.6.0EncryptionDetails_AlgorithmId":{"id":"components/schemas/ocsfv1.6.0EncryptionDetails_AlgorithmId","kind":"json-schema","title":"ocsfv1.6.0EncryptionDetails_AlgorithmId","data":{"title":"ocsfv1.6.0EncryptionDetails_AlgorithmId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"EncryptionDetailsAlgorithmId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The algorithm is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - DES: Data Encryption Standard Algorithm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - TripleDES: Triple Data Encryption Standard Algorithm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - AES: Advanced Encryption Standard Algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - RSA: Rivest-Shamir-Adleman Algorithm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - ECC: Elliptic Curve Cryptography Algorithm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - SM2: ShangMi Cryptographic Algorithm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The algorithm is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"algorithm"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0EndpointConnection":{"id":"components/schemas/ocsfv1.6.0EndpointConnection","kind":"json-schema","title":"ocsfv1.6.0EndpointConnection","data":{"title":"ocsfv1.6.0EndpointConnection","type":"object","description":"The Endpoint Connection object contains information detailing a connection attempt to an endpoint.","properties":{"code":{"type":"integer","nullable":true,"description":"A numerical response status code providing details about the connection."},"network_endpoint":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkEndpoint","nullable":true,"description":"Provides characteristics of the network endpoint."}}}},"components/schemas/ocsfv1.6.0Enrichment":{"id":"components/schemas/ocsfv1.6.0Enrichment","kind":"json-schema","title":"ocsfv1.6.0Enrichment","data":{"title":"ocsfv1.6.0Enrichment","type":"object","description":"The Enrichment object provides inline enrichment data for specific attributes of interest within an event. It serves as a mechanism to enhance or supplement the information associated with the event by adding additional relevant details or context.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the enrichment data was generated."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the enrichment data was generated."},"data":{"description":"The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record."},"desc":{"type":"string","nullable":true,"description":"A long description of the enrichment data."},"name":{"type":"string","description":"The name of the attribute to which the enriched data pertains."},"provider":{"type":"string","nullable":true,"description":"The enrichment data provider name."},"reputation":{"$ref":"#/components/schemas/ocsfv1.6.0Reputation","nullable":true,"description":"The reputation of the enrichment data."},"short_desc":{"type":"string","nullable":true,"description":"A short description of the enrichment data."},"src_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":"The URL of the source of the enrichment data."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The enrichment type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"location"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"value":{"type":"string","description":"The value of the attribute to which the enriched data pertains."}},"required":["data","name","value"]}},"components/schemas/ocsfv1.6.0EnvironmentVariable":{"id":"components/schemas/ocsfv1.6.0EnvironmentVariable","kind":"json-schema","title":"ocsfv1.6.0EnvironmentVariable","data":{"title":"ocsfv1.6.0EnvironmentVariable","type":"object","description":"An environment variable.","properties":{"name":{"type":"string","description":"The name of the environment variable."},"value":{"type":"string","description":"The value of the environment variable."}},"required":["name","value"]}},"components/schemas/ocsfv1.6.0Epss":{"id":"components/schemas/ocsfv1.6.0Epss","kind":"json-schema","title":"ocsfv1.6.0Epss","data":{"title":"ocsfv1.6.0Epss","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Exploit Prediction Scoring System (EPSS) object describes the estimated probability a vulnerability will be exploited. EPSS is a community-driven effort to combine descriptive information about vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild. ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/epss/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"EPSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The timestamp indicating when the EPSS score was calculated."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp indicating when the EPSS score was calculated."},"percentile":{"type":"number","format":"double","nullable":true,"description":"The EPSS score's percentile representing relative importance and ranking of the score in the larger EPSS dataset."},"score":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The EPSS score representing the probability [0-1] of exploitation in the wild in the next 30 days (following score publication)."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":"The version of the EPSS model used to calculate the score."}},"required":["score"]}},"components/schemas/ocsfv1.6.0Extension":{"id":"components/schemas/ocsfv1.6.0Extension","kind":"json-schema","title":"ocsfv1.6.0Extension","data":{"title":"ocsfv1.6.0Extension","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The OCSF Schema Extension object provides detailed information about the schema extension used to construct the event. The schema extensions are registered in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://github.com/ocsf/ocsf-schema/blob/main/extensions.md"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"extensions.md"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" file."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The schema extension name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dev"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The schema extension unique identifier. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"999"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The schema extension version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.0.0-alpha.2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["name","uid","version"]}},"components/schemas/ocsfv1.6.0Feature":{"id":"components/schemas/ocsfv1.6.0Feature","kind":"json-schema","title":"ocsfv1.6.0Feature","data":{"title":"ocsfv1.6.0Feature","type":"object","description":"The Feature object provides information about the software product feature that generated a specific event. It encompasses details related to the capabilities, components, user interface (UI) design, and performance upgrades associated with the feature.","properties":{"name":{"type":"string","nullable":true,"description":"The name of the feature."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the feature."},"version":{"type":"string","nullable":true,"description":"The version of the feature."}}}},"components/schemas/ocsfv1.6.0File":{"id":"components/schemas/ocsfv1.6.0File","kind":"json-schema","title":"ocsfv1.6.0File","data":{"title":"ocsfv1.6.0File","type":"object","description":"The File object represents the metadata associated with a file stored in a computer system. It encompasses information about the file itself, including its attributes, properties, and organizational details.","properties":{"accessed_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the file was last accessed."},"accessed_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the file was last accessed."},"accessor":{"$ref":"#/components/schemas/ocsfv1.6.0User","nullable":true,"description":"The name of the user who last accessed the object."},"accessor_app":{"$ref":"#/components/schemas/ocsfv1.6.0Product","nullable":true,"description":"The app which mediated access to the file. This could be separate from the source app, for example a case where a user exports a report from a web app. The source app would be their browser and the accessor app the web app."},"attributes":{"type":"integer","nullable":true,"description":"The bitmask value that represents the file attributes."},"company_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the company that published the file. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Microsoft Corporation"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidentiality":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidentiality_id":{"$ref":"#/components/schemas/ocsfv1.6.0File_ConfidentialityId","nullable":true,"description":"The normalized identifier of the file content confidentiality indicator."},"created_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the file was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the file was created."},"creator":{"$ref":"#/components/schemas/ocsfv1.6.0User","nullable":true,"description":"The user that created the file."},"desc":{"type":"string","nullable":true,"description":"The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type."},"drive_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The drive type, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"drive_type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"drive_type_id":{"$ref":"#/components/schemas/ocsfv1.6.0File_DriveTypeId","nullable":true,"description":"Identifies the type of a disk drive, i.e. fixed, removable, etc."},"encryption_details":{"$ref":"#/components/schemas/ocsfv1.6.0EncryptionDetails","nullable":true,"description":"The encryption details of the file. Should be populated if the file is encrypted."},"ext":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The extension of the file, excluding the leading dot. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"svchost.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"gz"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"export.tar.gz"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"hashes":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Fingerprint"},"nullable":true,"description":"An array of hash attributes."},"internal_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the file as identified within the file itself. This contrasts with the name by which the file is known on disk. Where available, the internal name is widely used by security practitioners and detection content because the on-disk file name is not reliable. On the Windows OS, most PE files contain a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"href":"https://learn.microsoft.com/en-us/windows/win32/menurc/versioninfo-resource"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"VERSIONINFO"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" resource from which the internal name can be obtained. On macOS, binaries can optionally embed a copy of the application's Info.plist file which in turn contains the name of the executable."},"children":[],"type":"text"}],"type":"paragraph"}]},"is_deleted":{"type":"boolean","nullable":true,"description":"Indicates if the file was deleted from the filesystem."},"is_encrypted":{"type":"boolean","nullable":true,"description":"Indicates if the file is encrypted."},"is_public":{"type":"boolean","nullable":true,"description":"Indicates if the file is publicly accessible. For example in an object's public access in AWS S3"},"is_readonly":{"type":"boolean","nullable":true,"description":"Indicates that the file cannot be modified."},"is_system":{"type":"boolean","nullable":true,"description":"The indication of whether the object is part of the operating system."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Labels associated with the object, such as security or sensitivity labels created by a scanning app."},"mime_type":{"type":"string","nullable":true,"description":"The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the file was last modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the file was last modified."},"modifier":{"$ref":"#/components/schemas/ocsfv1.6.0User","nullable":true,"description":"The user that last modified the file."},"name":{"$ref":"#/components/schemas/ocsfv1.6.0FileName","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the file. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"svchost.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"owner":{"$ref":"#/components/schemas/ocsfv1.6.0User","nullable":true,"description":"The user that owns the file/object."},"parent_folder":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The parent folder in which the file resides. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"c:\\windows\\system32"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"path":{"$ref":"#/components/schemas/ocsfv1.6.0FilePath","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full path to the file. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"c:\\windows\\system32\\svchost.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"product":{"$ref":"#/components/schemas/ocsfv1.6.0Product","nullable":true,"description":"The product that created or installed the file."},"security_descriptor":{"type":"string","nullable":true,"description":"The object security descriptor."},"signature":{"$ref":"#/components/schemas/ocsfv1.6.0DigitalSignature","nullable":true,"description":"The digital signature of the file."},"size":{"type":"integer","nullable":true,"description":"The size of data, in bytes."},"storage_class":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The storage class of the file. For example in AWS S3: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"STANDARD, STANDARD_IA, GLACIER"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the file."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":"The file type."},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0File_TypeId","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The file type ID. Note the distinction between a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Regular File"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Executable File"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". If the distinction is not known, or not indicated by the log, use "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Regular File"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In this case, it should not be assumed that a Regular File is not executable."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the file as defined by the storage system, such the file system file ID."},"uri":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The file URI, such as those reporting by static analysis tools. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"file:///C:/dev/sarif/sarif-tutorials/samples/Introduction/simple-example.js"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"url":{"$ref":"#/components/schemas/ocsfv1.6.0Url","nullable":true,"description":"The URL of the file, when applicable."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The file version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"8.0.7601.17514"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"volume":{"type":"string","nullable":true,"description":"The volume on the storage device where the file is located."},"xattributes":{"$ref":"#/components/schemas/ocsfv1.6.0Object","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An unordered collection of zero or more name/value pairs where each pair represents a file or folder extended attribute."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example: Windows alternate data stream attributes (ADS stream name, ADS size, etc.), user-defined or application-defined attributes, ACL, owner, primary group, etc. Examples from DCS: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ads_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ads_size"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dacl"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"owner"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"primary_group"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"link_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" - name of the link associated to the file."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"hard_link_count"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" - the number of links that are associated to the file."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"required":["name","type_id"]}},"components/schemas/ocsfv1.6.0File_ConfidentialityId":{"id":"components/schemas/ocsfv1.6.0File_ConfidentialityId","kind":"json-schema","title":"ocsfv1.6.0File_ConfidentialityId","data":{"title":"ocsfv1.6.0File_ConfidentialityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FileConfidentialityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The confidentiality is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - NotConfidential"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Confidential"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Secret"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - TopSecret"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Private"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Restricted"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidentiality is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidentiality"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0File_DriveTypeId":{"id":"components/schemas/ocsfv1.6.0File_DriveTypeId","kind":"json-schema","title":"ocsfv1.6.0File_DriveTypeId","data":{"title":"ocsfv1.6.0File_DriveTypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FileDriveTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The drive type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Removable: The drive has removable media; for example, a floppy drive, thumb drive, or flash card reader."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Fixed: The drive has fixed media; for example, a hard disk drive or flash drive."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Remote: The drive is a remote (network) drive."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - ROM: The drive is a CD-ROM drive."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - RAMDisk: The drive is a RAM disk."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The drive type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"drive_type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0File_TypeId":{"id":"components/schemas/ocsfv1.6.0File_TypeId","kind":"json-schema","title":"ocsfv1.6.0File_TypeId","data":{"title":"ocsfv1.6.0File_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FileTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - RegularFile"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Folder"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - CharacterDevice"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - BlockDevice"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - LocalSocket"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - NamedPipe"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - SymbolicLink"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - ExecutableFile"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Fingerprint":{"id":"components/schemas/ocsfv1.6.0Fingerprint","kind":"json-schema","title":"ocsfv1.6.0Fingerprint","data":{"title":"ocsfv1.6.0Fingerprint","type":"object","description":"The Fingerprint object provides detailed information about a digital fingerprint, which is a compact representation of data used to identify a longer piece of information, such as a public key or file content. It contains the algorithm and value of the fingerprint, enabling efficient and reliable identification of the associated data.","properties":{"algorithm":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash algorithm used to create the digital fingerprint, normalized to the caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"algorithm_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"algorithm_id":{"$ref":"#/components/schemas/ocsfv1.6.0Fingerprint_AlgorithmId","description":"The identifier of the normalized hash algorithm, which was used to create the digital fingerprint."},"value":{"$ref":"#/components/schemas/ocsfv1.6.0Hash","description":"The digital fingerprint value."}},"required":["algorithm_id","value"]}},"components/schemas/ocsfv1.6.0Fingerprint_AlgorithmId":{"id":"components/schemas/ocsfv1.6.0Fingerprint_AlgorithmId","kind":"json-schema","title":"ocsfv1.6.0Fingerprint_AlgorithmId","data":{"title":"ocsfv1.6.0Fingerprint_AlgorithmId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FingerprintAlgorithmId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The algorithm is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context Triggered Piecewise Hash (CTPH)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - TLSH: The TLSH fuzzy hashing algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that works by XORing the bytes in a circular-shifting fashion."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - 224: Secure Hash Algorithm 2 producing a 224-bit (28-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - 384: Secure Hash Algorithm 2 producing a 384-bit (48-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - 512_224: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash value truncated to a 224-bit (28-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - 512_256: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash value truncated to a 256-bit (32-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - 224: Secure Hash Algorithm 3 producing a 224-bit (28-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - 256: Secure Hash Algorithm 3 producing a 256-bit (32-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - 384: Secure Hash Algorithm 3 producing a 384-bit (48-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - 512: Secure Hash Algorithm 3 producing a 512-bit (64-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - bit: xxHash H3 producing a 64-bit hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - bit: xxHash H3 producing a 128-bit hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The algorithm is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"algorithm"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0FirewallRule":{"id":"components/schemas/ocsfv1.6.0FirewallRule","kind":"json-schema","title":"ocsfv1.6.0FirewallRule","data":{"title":"ocsfv1.6.0FirewallRule","type":"object","description":"The Firewall Rule object represents a specific rule within a firewall policy or event. It contains information about a rule's configuration, properties, and associated actions that define how network traffic is handled by the firewall.","properties":{"category":{"type":"string","nullable":true,"description":"The rule category."},"condition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The rule trigger condition for the rule. For example: SQL_INJECTION."},"children":[],"type":"text"}],"type":"paragraph"}]},"desc":{"type":"string","nullable":true,"description":"The description of the rule that generated the event."},"duration":{"type":"integer","nullable":true,"description":"The rule response time duration, usually used for challenge completion time."},"match_details":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The data in a request that rule matched. For example: '[\"10\",\"and\",\"1\"]'."},"children":[],"type":"text"}],"type":"paragraph"}]},"match_location":{"type":"string","nullable":true,"description":"The location of the matched data in the source which resulted in the triggered firewall rule. For example: HEADER."},"name":{"type":"string","nullable":true,"description":"The name of the rule that generated the event."},"rate_limit":{"type":"integer","nullable":true,"description":"The rate limit for a rate-based rule."},"sensitivity":{"type":"string","nullable":true,"description":"The sensitivity of the firewall rule in the matched event. For example: HIGH."},"type":{"type":"string","nullable":true,"description":"The rule type."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the rule that generated the event."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The rule version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.6.0Group":{"id":"components/schemas/ocsfv1.6.0Group","kind":"json-schema","title":"ocsfv1.6.0Group","data":{"title":"ocsfv1.6.0Group","type":"object","description":"The Group object represents a collection or association of entities, such as users, policies, or devices. It serves as a logical grouping mechanism to organize and manage entities with similar characteristics or permissions within a system or organization, including but not limited to purposes of access control.","properties":{"desc":{"type":"string","nullable":true,"description":"The group description."},"domain":{"type":"string","nullable":true,"description":"The domain where the group is defined. For example: the LDAP or Active Directory domain."},"email_addr":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress","nullable":true,"description":"The group's email address. For example, a Google Group email address."},"name":{"type":"string","nullable":true,"description":"The group name."},"privileges":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The group privileges."},"type":{"type":"string","nullable":true,"description":"The type of the group or account."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group."}}}},"components/schemas/ocsfv1.6.0HttpCookie":{"id":"components/schemas/ocsfv1.6.0HttpCookie","kind":"json-schema","title":"ocsfv1.6.0HttpCookie","data":{"title":"ocsfv1.6.0HttpCookie","type":"object","description":"The HTTP Cookie object, also known as a web cookie or browser cookie, contains details and values pertaining to a small piece of data that a server sends to a user's web browser. This data is then stored by the browser and sent back to the server with subsequent requests, allowing the server to remember and track certain information about the user's browsing session or preferences.","properties":{"domain":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The domain name for the server from which the http_cookie is served."},"children":[],"type":"text"}],"type":"paragraph"}]},"expiration_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The expiration time of the HTTP cookie."},"expiration_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The expiration time of the HTTP cookie."},"http_only":{"type":"boolean","nullable":true,"description":"A cookie attribute to make it inaccessible via JavaScript"},"is_http_only":{"type":"boolean","nullable":true,"description":"This attribute prevents the cookie from being accessed via JavaScript."},"is_secure":{"type":"boolean","nullable":true,"description":"The cookie attribute indicates that cookies are sent to the server only when the request is encrypted using the HTTPS protocol."},"name":{"type":"string","description":"The HTTP cookie name."},"path":{"type":"string","nullable":true,"description":"The path of the HTTP cookie."},"samesite":{"type":"string","nullable":true,"description":"The cookie attribute that lets servers specify whether/when cookies are sent with cross-site requests. Values are: Strict, Lax or None"},"secure":{"type":"boolean","nullable":true,"description":"The cookie attribute to only send cookies to the server with an encrypted request over the HTTPS protocol."},"value":{"type":"string","description":"The HTTP cookie value."}},"required":["name","value"]}},"components/schemas/ocsfv1.6.0HttpHeader":{"id":"components/schemas/ocsfv1.6.0HttpHeader","kind":"json-schema","title":"ocsfv1.6.0HttpHeader","data":{"title":"ocsfv1.6.0HttpHeader","type":"object","description":"The HTTP Header object represents the headers sent in an HTTP request or response. HTTP headers are key-value pairs that convey additional information about the HTTP message, including details about the content, caching, authentication, encoding, and other aspects of the communication.","properties":{"name":{"type":"string","description":"The name of the HTTP header."},"value":{"type":"string","description":"The value of the HTTP header."}},"required":["name","value"]}},"components/schemas/ocsfv1.6.0HttpRequest":{"id":"components/schemas/ocsfv1.6.0HttpRequest","kind":"json-schema","title":"ocsfv1.6.0HttpRequest","data":{"title":"ocsfv1.6.0HttpRequest","type":"object","description":"The HTTP Request object represents the attributes of a request made to a web server. It encapsulates the details and metadata associated with an HTTP request, including the request method, headers, URL, query parameters, body content, and other relevant information.","properties":{"args":{"type":"string","nullable":true,"description":"The arguments sent along with the HTTP request."},"body_length":{"type":"integer","nullable":true,"description":"The actual length of the HTTP request body, in number of bytes, independent of a potentially existing Content-Length header."},"http_headers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0HttpHeader"},"nullable":true,"description":"Additional HTTP headers of an HTTP request or response."},"http_method":{"$ref":"#/components/schemas/ocsfv1.6.0HttpRequest_HttpMethod","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"HTTP request method"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" indicates the desired action to be performed for a given resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"length":{"type":"integer","nullable":true,"description":"The length of the entire HTTP request, in number of bytes."},"referrer":{"type":"string","nullable":true,"description":"The request header that identifies the address of the previous web page, which is linked to the current web page or resource being requested."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the http request."},"url":{"$ref":"#/components/schemas/ocsfv1.6.0Url","nullable":true,"description":"The URL object that pertains to the request."},"user_agent":{"type":"string","nullable":true,"description":"The request header that identifies the operating system and web browser."},"user_agent_name":{"type":"string","nullable":true,"description":"Concise version of the user agent, e.g. Chrome or Firefox instead of the full user-agent string."},"version":{"type":"string","nullable":true,"description":"The Hypertext Transfer Protocol (HTTP) version."},"x_forwarded_for":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0IPAddress"},"nullable":true,"description":"The X-Forwarded-For header identifying the originating IP address(es) of a client connecting to a web server through an HTTP proxy or a load balancer."}}}},"components/schemas/ocsfv1.6.0HttpRequest_HttpMethod":{"id":"components/schemas/ocsfv1.6.0HttpRequest_HttpMethod","kind":"json-schema","title":"ocsfv1.6.0HttpRequest_HttpMethod","data":{"title":"ocsfv1.6.0HttpRequest_HttpMethod","type":"string","description":"HttpRequestHttpMethod is an enum, and the following values are allowed.\nCONNECT - Connect: The CONNECT method establishes a tunnel to the server identified by the target resource.\nDELETE - Delete: The DELETE method deletes the specified resource.\nGET - Get: The GET method requests a representation of the specified resource. Requests using GET should only retrieve data.\nHEAD - Head: The HEAD method asks for a response identical to a GET request, but without the response body.\nOPTIONS - Options: The OPTIONS method describes the communication options for the target resource.\nPATCH - Patch: The PATCH method applies partial modifications to a resource.\nPOST - Post: The POST method submits an entity to the specified resource, often causing a change in state or side effects on the server.\nPUT - Put: The PUT method replaces all current representations of the target resource with the request payload.\nTRACE - Trace: The TRACE method performs a message loop-back test along the path to the target resource."}},"components/schemas/ocsfv1.6.0HttpResponse":{"id":"components/schemas/ocsfv1.6.0HttpResponse","kind":"json-schema","title":"ocsfv1.6.0HttpResponse","data":{"title":"ocsfv1.6.0HttpResponse","type":"object","description":"The HTTP Response object contains detailed information about the response sent from a web server to the requester. It encompasses attributes and metadata that describe the response status, headers, body content, and other relevant information.","properties":{"body_length":{"type":"integer","nullable":true,"description":"The actual length of the HTTP response body, in number of bytes, independent of a potentially existing Content-Length header."},"code":{"type":"integer","description":"The Hypertext Transfer Protocol (HTTP) status code returned from the web server to the client. For example, 200."},"content_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The request header that identifies the original "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.iana.org/assignments/media-types/media-types.xhtml"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"media type "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the resource (prior to any content encoding applied for sending)."},"children":[],"type":"text"}],"type":"paragraph"}]},"http_headers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0HttpHeader"},"nullable":true,"description":"Additional HTTP headers of an HTTP request or response."},"latency":{"type":"integer","nullable":true,"description":"The HTTP response latency measured in milliseconds."},"length":{"type":"integer","nullable":true,"description":"The length of the entire HTTP response, in number of bytes."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"status":{"type":"string","nullable":true,"description":"The response status. For example: A successful HTTP status of 'OK' which corresponds to a code of 200."}},"required":["code"]}},"components/schemas/ocsfv1.6.0Idp":{"id":"components/schemas/ocsfv1.6.0Idp","kind":"json-schema","title":"ocsfv1.6.0Idp","data":{"title":"ocsfv1.6.0Idp","type":"object","description":"The Identity Provider object contains detailed information about a provider responsible for creating, maintaining, and managing identity information while offering authentication services to applications. An Identity Provider (IdP) serves as a trusted authority that verifies the identity of users and issues authentication tokens or assertions to enable secure access to applications or services.","properties":{"auth_factors":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0AuthFactor"},"nullable":true,"description":"The Authentication Factors object describes the different types of Multi-Factor Authentication (MFA) methods and/or devices supported by the Identity Provider."},"domain":{"type":"string","nullable":true,"description":"The primary domain associated with the Identity Provider."},"fingerprint":{"$ref":"#/components/schemas/ocsfv1.6.0Fingerprint","nullable":true,"description":"The fingerprint of the X.509 certificate used by the Identity Provider."},"has_mfa":{"type":"boolean","nullable":true,"description":"The Identity Provider enforces Multi Factor Authentication (MFA)."},"issuer":{"type":"string","nullable":true,"description":"The unique identifier (often a URL) used by the Identity Provider as its issuer."},"name":{"type":"string","nullable":true,"description":"The name of the Identity Provider."},"protocol_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The supported protocol of the Identity Provider. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SAML"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OIDC"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OAuth2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"scim":{"$ref":"#/components/schemas/ocsfv1.6.0Scim","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The System for Cross-domain Identity Management (SCIM) resource object provides a structured set of attributes related to SCIM protocols used for identity provisioning and management across cloud-based platforms. It standardizes user and group provisioning details, enabling identity synchronization and lifecycle management with compatible Identity Providers (IdPs) and applications. SCIM is defined in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc7643"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-7634"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"sso":{"$ref":"#/components/schemas/ocsfv1.6.0Sso","nullable":true,"description":"The Single Sign-On (SSO) object provides a structure for normalizing SSO attributes, configuration, and/or settings from Identity Providers."},"state":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The configuration state of the Identity Provider, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"state_id":{"$ref":"#/components/schemas/ocsfv1.6.0Idp_StateId","nullable":true,"description":"The normalized state ID of the Identity Provider to reflect its configuration or activation status."},"tenant_uid":{"type":"string","nullable":true,"description":"The tenant ID associated with the Identity Provider."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the Identity Provider."},"url_string":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":"The URL for accessing the configuration or metadata of the Identity Provider."}}}},"components/schemas/ocsfv1.6.0Idp_StateId":{"id":"components/schemas/ocsfv1.6.0Idp_StateId","kind":"json-schema","title":"ocsfv1.6.0Idp_StateId","data":{"title":"ocsfv1.6.0Idp_StateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IdpStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The configuration state of the Identity Provider is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Active: The Identity Provider is in an Active state, or otherwise enabled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Suspended: The Identity Provider is in a Suspended state."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Deprecated: The Identity Provider is in a Deprecated state, or is otherwise disabled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Deleted: The Identity Provider is in a Deleted state."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The configuration state of the Identity Provider is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Image":{"id":"components/schemas/ocsfv1.6.0Image","kind":"json-schema","title":"ocsfv1.6.0Image","data":{"title":"ocsfv1.6.0Image","type":"object","description":"The Image object provides a description of a specific Virtual Machine (VM) or Container image.","properties":{"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels associated to the image."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The image name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"elixir"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"path":{"$ref":"#/components/schemas/ocsfv1.6.0FilePath","nullable":true,"description":"The full path to the image file."},"tag":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The image tag. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.11-alpine"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the image."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique image ID. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"77af4d6b9913"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["uid"]}},"components/schemas/ocsfv1.6.0Ja4Fingerprint":{"id":"components/schemas/ocsfv1.6.0Ja4Fingerprint","kind":"json-schema","title":"ocsfv1.6.0Ja4Fingerprint","data":{"title":"ocsfv1.6.0Ja4Fingerprint","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The JA4+ fingerprint object provides detailed fingerprint information about various aspects of network traffic which is both machine and human readable."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"section_a":{"type":"string","nullable":true,"description":"The 'a' section of the JA4 fingerprint."},"section_b":{"type":"string","nullable":true,"description":"The 'b' section of the JA4 fingerprint."},"section_c":{"type":"string","nullable":true,"description":"The 'c' section of the JA4 fingerprint."},"section_d":{"type":"string","nullable":true,"description":"The 'd' section of the JA4 fingerprint."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The JA4+ fingerprint type as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"href":"https://blog.foxio.io/ja4+-network-fingerprinting target="}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FoxIO"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", normalized to the caption of 'type_id'. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0Ja4Fingerprint_TypeId","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The identifier of the JA4+ fingerprint type."},"children":[],"type":"text"}],"type":"paragraph"}]},"value":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The JA4+ fingerprint value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["type_id","value"]}},"components/schemas/ocsfv1.6.0Ja4Fingerprint_TypeId":{"id":"components/schemas/ocsfv1.6.0Ja4Fingerprint_TypeId","kind":"json-schema","title":"ocsfv1.6.0Ja4Fingerprint_TypeId","data":{"title":"ocsfv1.6.0Ja4Fingerprint_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Ja4FingerprintTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - JA4: TLS Client Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - JA4Server: TLS Server Response/Session Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - JA4HTTP: HTTP Client Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - JA4Latency: Latency Measurement/Light Distance Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - JA4X509: X509 TLS Certificate Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - JA4SSH: SSH Traffic Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - JA4TCP: Passive TCP Client Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - JA4TCPServer: Passive TCP Server Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - JA4TCPScan: Active TCP Server Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0KbArticle":{"id":"components/schemas/ocsfv1.6.0KbArticle","kind":"json-schema","title":"ocsfv1.6.0KbArticle","data":{"title":"ocsfv1.6.0KbArticle","type":"object","description":"The KB Article object contains metadata that describes the patch or update.","properties":{"avg_timespan":{"$ref":"#/components/schemas/ocsfv1.6.0Timespan","nullable":true,"description":"The average time to patch."},"bulletin":{"type":"string","nullable":true,"description":"The kb article bulletin identifier."},"classification":{"type":"string","nullable":true,"description":"The vendors classification of the kb article."},"created_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The date the kb article was released by the vendor."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The date the kb article was released by the vendor."},"install_state":{"type":"string","nullable":true,"description":"The install state of the kb article."},"install_state_id":{"$ref":"#/components/schemas/ocsfv1.6.0KbArticle_InstallStateId","nullable":true,"description":"The normalized install state ID of the kb article."},"is_superseded":{"type":"boolean","nullable":true,"description":"The kb article has been replaced by another."},"os":{"$ref":"#/components/schemas/ocsfv1.6.0Os","nullable":true,"description":"The operating system the kb article applies."},"product":{"$ref":"#/components/schemas/ocsfv1.6.0Product","nullable":true,"description":"The product details the kb article applies."},"severity":{"type":"string","nullable":true,"description":"The severity of the kb article."},"size":{"type":"integer","nullable":true,"description":"The size in bytes for the kb article."},"src_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":"The kb article link from the source vendor."},"title":{"type":"string","nullable":true,"description":"The title of the kb article."},"uid":{"type":"string","nullable":true,"description":"The unique identifier for the kb article."}}}},"components/schemas/ocsfv1.6.0KbArticle_InstallStateId":{"id":"components/schemas/ocsfv1.6.0KbArticle_InstallStateId","kind":"json-schema","title":"ocsfv1.6.0KbArticle_InstallStateId","data":{"title":"ocsfv1.6.0KbArticle_InstallStateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"KbArticleInstallStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized install state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Installed: The item is installed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - NotInstalled: The item is not installed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - InstalledPendingReboot: The item is installed pending reboot operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The install state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"install_state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0KeyValueObject":{"id":"components/schemas/ocsfv1.6.0KeyValueObject","kind":"json-schema","title":"ocsfv1.6.0KeyValueObject","data":{"title":"ocsfv1.6.0KeyValueObject","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A generic object allowing to define a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pair."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","description":"The name of the key."},"value":{"type":"string","nullable":true,"description":"The value associated to the key."},"values":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Optional, the values associated to the key. You can populate this attribute, when you have multiple values for the same key."}},"required":["name"]}},"components/schemas/ocsfv1.6.0KeyboardInfo":{"id":"components/schemas/ocsfv1.6.0KeyboardInfo","kind":"json-schema","title":"ocsfv1.6.0KeyboardInfo","data":{"title":"ocsfv1.6.0KeyboardInfo","type":"object","description":"The Keyboard Information object contains details and attributes related to a computer or device keyboard. It encompasses information that describes the characteristics, capabilities, and configuration of the keyboard.","properties":{"function_keys":{"type":"integer","nullable":true,"description":"The number of function keys on client keyboard."},"ime":{"type":"string","nullable":true,"description":"The Input Method Editor (IME) file name."},"keyboard_layout":{"type":"string","nullable":true,"description":"The keyboard locale identifier name (e.g., en-US)."},"keyboard_subtype":{"type":"integer","nullable":true,"description":"The keyboard numeric code."},"keyboard_type":{"type":"string","nullable":true,"description":"The keyboard type (e.g., xt, ico)."}}}},"components/schemas/ocsfv1.6.0KillChainPhase":{"id":"components/schemas/ocsfv1.6.0KillChainPhase","kind":"json-schema","title":"ocsfv1.6.0KillChainPhase","data":{"title":"ocsfv1.6.0KillChainPhase","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Kill Chain Phase object represents a single phase of a cyber attack, including the initial reconnaissance and planning stages up to the final objective of the attacker. It provides a detailed description of each phase and its associated activities within the broader context of a cyber attack. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Cyber Kill Chain®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"phase":{"type":"string","nullable":true,"description":"The cyber kill chain phase."},"phase_id":{"$ref":"#/components/schemas/ocsfv1.6.0KillChainPhase_PhaseId","description":"The cyber kill chain phase identifier."}},"required":["phase_id"]}},"components/schemas/ocsfv1.6.0KillChainPhase_PhaseId":{"id":"components/schemas/ocsfv1.6.0KillChainPhase_PhaseId","kind":"json-schema","title":"ocsfv1.6.0KillChainPhase_PhaseId","data":{"title":"ocsfv1.6.0KillChainPhase_PhaseId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"KillChainPhasePhaseId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The kill chain phase is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Reconnaissance: The attackers pick a target and perform a detailed analysis, start collecting information (email addresses, conferences information, etc.) and evaluate the victim’s vulnerabilities to determine how to exploit them."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Weaponization: The attackers develop a malware weapon and aim to exploit the discovered vulnerabilities."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Delivery: The intruders will use various tactics, such as phishing, infected USB drives, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Exploitation: The intruders start leveraging vulnerabilities to executed code on the victim’s system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Installation: The intruders install malware on the victim’s system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Control: Malware opens a command channel to enable the intruders to remotely manipulate the victim's system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - ActionsonObjectives: With hands-on keyboard access, intruders accomplish the mission’s goal."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The kill chain phase is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"phase"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0LdapPerson":{"id":"components/schemas/ocsfv1.6.0LdapPerson","kind":"json-schema","title":"ocsfv1.6.0LdapPerson","data":{"title":"ocsfv1.6.0LdapPerson","type":"object","description":"The additional LDAP attributes that describe a person.","properties":{"cost_center":{"type":"string","nullable":true,"description":"The cost center associated with the user."},"created_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The timestamp when the user was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user was created."},"deleted_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The timestamp when the user was deleted. In Active Directory (AD), when a user is deleted they are moved to a temporary container and then removed after 30 days. So, this field can be populated even after a user is deleted for the next 30 days."},"deleted_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user was deleted. In Active Directory (AD), when a user is deleted they are moved to a temporary container and then removed after 30 days. So, this field can be populated even after a user is deleted for the next 30 days."},"display_name":{"type":"string","nullable":true,"description":"The display name of the LDAP person. According to RFC 2798, this is the preferred name of a person to be used when displaying entries."},"eligible_for_rehire":{"type":"boolean","nullable":true,"description":"Indicates whether the user is eligible for rehire. This typically applies to terminated or retired employees."},"email_addrs":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress"},"nullable":true,"description":"A list of additional email addresses for the user."},"employee_uid":{"type":"string","nullable":true,"description":"The employee identifier assigned to the user by the organization."},"employment_status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The employment status, normalized to the caption of the employment_status_id value. In the case of 'Other', it is defined by the data source."},"children":[],"type":"text"}],"type":"paragraph"}]},"employment_status_date":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The timestamp when the employment status was last changed."},"employment_status_date_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the employment status was last changed."},"employment_status_id":{"$ref":"#/components/schemas/ocsfv1.6.0LdapPerson_EmploymentStatusId","nullable":true,"description":"The normalized identifier of the user's employment status."},"given_name":{"type":"string","nullable":true,"description":"The given or first name of the user."},"hire_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The timestamp when the user was or will be hired by the organization."},"hire_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user was or will be hired by the organization."},"job_title":{"type":"string","nullable":true,"description":"The user's job title."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The labels associated with the user. For example in AD this could be the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"userType"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"employeeType"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Member, Employee"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"last_login_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The last time when the user logged in."},"last_login_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The last time when the user logged in."},"ldap_cn":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The LDAP and X.500 "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"commonName"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, typically the full name of the person. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"John Doe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"ldap_dn":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The X.500 Distinguished Name (DN) is a structured string that uniquely identifies an entry, such as a user, in an X.500 directory service For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cn=John Doe,ou=People,dc=example,dc=com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"leave_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The timestamp when the user left or will be leaving the organization."},"leave_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user left or will be leaving the organization."},"location":{"$ref":"#/components/schemas/ocsfv1.6.0Location","nullable":true,"description":"The geographical location associated with a user. This is typically the user's usual work location."},"manager":{"$ref":"#/components/schemas/ocsfv1.6.0Object","nullable":true,"description":"The user's manager. This helps in understanding an org hierarchy. This should only ever be populated once in an event. I.e. there should not be a manager's manager in an event."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The timestamp when the user entry was last modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user entry was last modified."},"office_location":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The primary office location associated with the user. This could be any string and isn't a specific address. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"South East Virtual"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"phone_number":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The telephone number of the user. Corresponds to the LDAP "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Telephone-Number"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" CN."},"children":[],"type":"text"}],"type":"paragraph"}]},"position_start_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The date the user first started work in their current position. For employees who have not changed positions, this equals the hire date. For employees who have transferred or been promoted, this reflects when they entered their current role."},"position_start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The date the user first started work in their current position. For employees who have not changed positions, this equals the hire date. For employees who have transferred or been promoted, this reflects when they entered their current role."},"regrettable_termination":{"type":"boolean","nullable":true,"description":"Indicates whether a termination is considered regrettable by the organization (i.e., loss of a valued employee). This is typically only populated for terminated employees."},"reports":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Object"},"nullable":true,"description":"The user's direct reports. This is the inverse of the manager relationship, representing users who report directly to this user in the organizational hierarchy. This field only includes immediate/direct reports, not transitive reports."},"surname":{"type":"string","nullable":true,"description":"The last or family name for the user."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the user."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.6.0LdapPerson_EmploymentStatusId":{"id":"components/schemas/ocsfv1.6.0LdapPerson_EmploymentStatusId","kind":"json-schema","title":"ocsfv1.6.0LdapPerson_EmploymentStatusId","data":{"title":"ocsfv1.6.0LdapPerson_EmploymentStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LdapPersonEmploymentStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The employment status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Applicant: The user is a job applicant or candidate who has not yet been hired."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Active: The user is currently employed and actively working."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Terminated: The user's employment has been terminated."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Retired: The user has retired from the organization."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The employment status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"employment_status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0LeaveEvent":{"id":"components/schemas/ocsfv1.6.0LeaveEvent","kind":"json-schema","title":"ocsfv1.6.0LeaveEvent","data":{"title":"ocsfv1.6.0LeaveEvent","type":"object","description":"A leave of absence event for a person. May represent a current, past, or future leave.","properties":{"desc":{"type":"string","nullable":true,"description":"The description that pertains to the object or event. See specific usage."},"leave_end_date":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The date on which the leave of absence ends."},"leave_end_date_dt":{"type":"string","format":"date-time","nullable":true,"description":"The date on which the leave of absence ends."},"leave_start_date":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The date on which the leave of absence begins."},"leave_start_date_dt":{"type":"string","format":"date-time","nullable":true,"description":"The date on which the leave of absence begins."}}}},"components/schemas/ocsfv1.6.0LoadBalancer":{"id":"components/schemas/ocsfv1.6.0LoadBalancer","kind":"json-schema","title":"ocsfv1.6.0LoadBalancer","data":{"title":"ocsfv1.6.0LoadBalancer","type":"object","description":"The load balancer object describes the load balancer entity and contains additional information regarding the distribution of traffic across a network.","properties":{"classification":{"type":"string","nullable":true,"description":"The request classification as defined by the load balancer."},"code":{"type":"integer","nullable":true,"description":"The numeric response status code detailing the connection from the load balancer to the destination target."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkEndpoint","nullable":true,"description":"The destination to which the load balancer is distributing traffic."},"endpoint_connections":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0EndpointConnection"},"nullable":true,"description":"An object detailing the load balancer connection attempts and responses."},"error_message":{"type":"string","nullable":true,"description":"The load balancer error message."},"ip":{"$ref":"#/components/schemas/ocsfv1.6.0IPAddress","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The IP address of the load balancer node that handled the client request. Note: the load balancer may have other IP addresses, and this is not an IP address of the target/distribution endpoint - see "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dst_endpoint"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The load balancer message."},"metrics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Metric"},"nullable":true,"description":"General purpose metrics associated with the load balancer."},"name":{"type":"string","nullable":true,"description":"The name of the load balancer."},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional status information about the load balancer distribution event."},"uid":{"type":"string","nullable":true,"description":"The unique identifier for the load balancer."}}}},"components/schemas/ocsfv1.6.0Location":{"id":"components/schemas/ocsfv1.6.0Location","kind":"json-schema","title":"ocsfv1.6.0Location","data":{"title":"ocsfv1.6.0Location","type":"object","description":"The Geo Location object describes a geographical location, usually associated with an IP address.","properties":{"aerial_height":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Expressed as either height above takeoff location or height above ground level (AGL) for a UAS current location. This value is provided in meters and must have a minimum resolution of 1 m. Special Values: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Invalid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"No Value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Unknown: -1000 m"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"city":{"type":"string","nullable":true,"description":"The name of the city."},"continent":{"type":"string","nullable":true,"description":"The name of the continent."},"coordinates":{"type":"array","items":{"type":"number","format":"double"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A two-element array, containing a longitude/latitude pair. The format conforms with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://geojson.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"GeoJSON"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[-73.983, 40.719]"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"country":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The ISO 3166-1 Alpha-2 country code."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" The two letter country code should be capitalized. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"US"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CA"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"desc":{"type":"string","nullable":true,"description":"The description of the geographical location."},"geodetic_altitude":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The aircraft distance above or below the ellipsoid as measured along a line that passes through the aircraft and is normal to the surface of the WGS-84 ellipsoid. This value is provided in meters and must have a minimum resolution of 1 m. Special Values: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Invalid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"No Value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Unknown: -1000 m"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"geodetic_vertical_accuracy":{"type":"string","nullable":true,"description":"Provides quality/containment on geodetic altitude. This is based on ADS-B Geodetic Vertical Accuracy (GVA). Measured in meters."},"geohash":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Geohash of the geo-coordinates (latitude and longitude)."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Geohash"}},"children":[{"$$mdtype":"Node","attributes":{"content":"Geohashing"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" is a geocoding system used to encode geographic coordinates in decimal degrees, to a single string."},"children":[],"type":"text"}]},"horizontal_accuracy":{"type":"string","nullable":true,"description":"Provides quality/containment on horizontal position. This is based on ADS-B NACp. Measured in meters."},"is_on_premises":{"type":"boolean","nullable":true,"description":"The indication of whether the location is on premises."},"isp":{"type":"string","nullable":true,"description":"The name of the Internet Service Provider (ISP)."},"lat":{"type":"number","format":"double","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The geographical Latitude coordinate represented in Decimal Degrees (DD). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"42.361145"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"long":{"type":"number","format":"double","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The geographical Longitude coordinate represented in Decimal Degrees (DD). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"-71.057083"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"postal_code":{"type":"string","nullable":true,"description":"The postal code of the location."},"pressure_altitude":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The uncorrected barometric pressure altitude (based on reference standard 29.92 inHg, 1013.25 mb) provides a reference for algorithms that utilize 'altitude deltas' between aircraft. This value is provided in meters and must have a minimum resolution of 1 m.. Special Values: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Invalid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"No Value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Unknown: -1000 m"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"provider":{"type":"string","nullable":true,"description":"The provider of the geographical location data."},"region":{"type":"string","nullable":true,"description":"The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. For example, 'CH-VD' for the Canton of Vaud, Switzerland"},"timezone":{"type":"string","nullable":true,"description":"Timezone string. This provides timezone information that may be present even when latitude and longitude are absent."}}}},"components/schemas/ocsfv1.6.0Logger":{"id":"components/schemas/ocsfv1.6.0Logger","kind":"json-schema","title":"ocsfv1.6.0Logger","data":{"title":"ocsfv1.6.0Logger","type":"object","description":"The Logger object represents the device and product where events are stored with times for receipt and transmission.  This may be at the source device where the event occurred, a remote scanning device, intermediate hops, or the ultimate destination.","properties":{"device":{"$ref":"#/components/schemas/ocsfv1.6.0Device","nullable":true,"description":"The device where the events are logged."},"event_uid":{"type":"string","nullable":true,"description":"The unique identifier of the event assigned by the logger."},"is_truncated":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates whether the OCSF event data has been truncated due to size limitations. When "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", some event data may have been omitted to fit within system constraints."},"children":[],"type":"text"}],"type":"paragraph"}]},"log_level":{"type":"string","nullable":true,"description":"The audit level at which an event was generated."},"log_name":{"type":"string","nullable":true,"description":"The event log name. For example, syslog file name or Windows logging subsystem: Security."},"log_provider":{"type":"string","nullable":true,"description":"The logging provider or logging service that logged the event. For example, Microsoft-Windows-Security-Auditing."},"log_version":{"type":"string","nullable":true,"description":"The event log schema version that specifies the format of the original event. For example syslog version or Cisco Log Schema Version."},"logged_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The time when the logging system collected and logged the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different."},"children":[],"type":"text"}]},"logged_time_dt":{"type":"string","format":"date-time","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The time when the logging system collected and logged the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different."},"children":[],"type":"text"}]},"name":{"type":"string","nullable":true,"description":"The name of the logging product instance."},"product":{"$ref":"#/components/schemas/ocsfv1.6.0Product","nullable":true,"description":"The product logging the event.  This may be the event source product, a management server product, a scanning product, a SIEM, etc."},"transmit_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the event was transmitted from the logging device to it's next destination."},"transmit_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the event was transmitted from the logging device to it's next destination."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the logging product instance."},"untruncated_size":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The original size of the OCSF event data in kilobytes before any truncation occurred. This field is typically populated when "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"is_truncated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to indicate the full size of the original event."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":"The version of the logging product."}}}},"components/schemas/ocsfv1.6.0LongString":{"id":"components/schemas/ocsfv1.6.0LongString","kind":"json-schema","title":"ocsfv1.6.0LongString","data":{"title":"ocsfv1.6.0LongString","type":"object","description":"This object is a used to capture strings which may be truncated by a security product due to their length.","properties":{"is_truncated":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" has been truncated. May be omitted if truncation has not occurred."},"children":[],"type":"text"}],"type":"paragraph"}]},"untruncated_size":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The size in bytes of the string represented by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" before truncation. Should be omitted if truncation has not occurred."},"children":[],"type":"text"}],"type":"paragraph"}]},"value":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The string value, truncated if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"is_truncated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["value"]}},"components/schemas/ocsfv1.6.0Malware":{"id":"components/schemas/ocsfv1.6.0Malware","kind":"json-schema","title":"ocsfv1.6.0Malware","data":{"title":"ocsfv1.6.0Malware","type":"object","description":"The Malware object describes the classification of known malicious software, which is intentionally designed to cause damage to a computer, server, client, or computer network.","properties":{"classification_ids":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Malware_ClassificationIds"},"description":"The list of normalized identifiers of the malware classifications."},"classifications":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of malware classifications, normalized to the captions of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"classification_ids"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" values. In the case of 'Other', they are defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"cves":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Cve"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of Common Vulnerabilities and Exposures (CVE) identifiers associated with the malware. Reference: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cve.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVE"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"files":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0File"},"nullable":true,"description":"The list of file objects representing files that were identified as infected by the malware."},"name":{"type":"string","nullable":true,"description":"The malware name, as reported by the detection engine."},"num_infected":{"type":"integer","nullable":true,"description":"The number of files that were identified to be infected by the malware."},"path":{"$ref":"#/components/schemas/ocsfv1.6.0FilePath","nullable":true,"description":"The filesystem path of the malware that was observed."},"provider":{"type":"string","nullable":true,"description":"The name or identifier of the security solution or service that provided the malware detection information."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The severity of the malware, normalized to the captions of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" values. In the case of 'Other', they are defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.6.0Malware_SeverityId","nullable":true,"description":"The normalized identifier of the malware severity."},"uid":{"type":"string","nullable":true,"description":"A unique identifier for the specific malware instance, as assigned by the detection engine (e.g., virus signature ID or IPS rule ID)."}},"required":["classification_ids"]}},"components/schemas/ocsfv1.6.0Malware_ClassificationIds":{"id":"components/schemas/ocsfv1.6.0Malware_ClassificationIds","kind":"json-schema","title":"ocsfv1.6.0Malware_ClassificationIds","data":{"title":"ocsfv1.6.0Malware_ClassificationIds","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MalwareClassificationIds is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The classification is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Adware"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Backdoor"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Bot"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Bootkit"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - DDOS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Downloader"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Dropper"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Kit"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Keylogger"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Ransomware"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Access_Trojan"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Exploitation"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Security_Software"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Rootkit"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - Capture"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Spyware"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Trojan"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Virus"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Webshell"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Wiper"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Worm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The classification is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"classifications"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Malware_SeverityId":{"id":"components/schemas/ocsfv1.6.0Malware_SeverityId","kind":"json-schema","title":"ocsfv1.6.0Malware_SeverityId","data":{"title":"ocsfv1.6.0Malware_SeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MalwareSeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0MalwareScanInfo":{"id":"components/schemas/ocsfv1.6.0MalwareScanInfo","kind":"json-schema","title":"ocsfv1.6.0MalwareScanInfo","data":{"title":"ocsfv1.6.0MalwareScanInfo","type":"object","description":"The malware scan information object describes characteristics, metadata of a malware scanning job.","properties":{"end_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The timestamp indicating when the scan job completed execution."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp indicating when the scan job completed execution."},"name":{"type":"string","nullable":true,"description":"The administrator-supplied or application-generated name of the scan. For example: \"Home office weekly user database scan\", \"Scan folders for viruses\", \"Full system virus scan\""},"num_files":{"type":"integer","nullable":true,"description":"The total number of files analyzed during the scan."},"num_infected":{"type":"integer","nullable":true,"description":"The total number of files identified as infected with malware during the scan."},"num_volumes":{"type":"integer","nullable":true,"description":"The total number of storage volumes examined during the malware scan."},"size":{"type":"integer","nullable":true,"description":"The total size in bytes of all files that were scanned."},"start_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The timestamp indicating when the scan job began execution."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp indicating when the scan job began execution."},"targets":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Hosts or IP addresses targeted by the scan."},"type":{"type":"string","nullable":true,"description":"The type of scan."},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0MalwareScanInfo_TypeId","description":"The type id of the scan."},"uid":{"type":"string","nullable":true,"description":"The application-defined unique identifier assigned to an instance of a scan."},"unique_malware_count":{"type":"integer","nullable":true,"description":"The number of unique malware detected across all infected files."}},"required":["type_id"]}},"components/schemas/ocsfv1.6.0MalwareScanInfo_TypeId":{"id":"components/schemas/ocsfv1.6.0MalwareScanInfo_TypeId","kind":"json-schema","title":"ocsfv1.6.0MalwareScanInfo_TypeId","data":{"title":"ocsfv1.6.0MalwareScanInfo_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MalwareScanInfoTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Manual: The scan was manually initiated by the user or administrator."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Scheduled: The scan was started based on scheduler."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - UpdatedContent: The scan was triggered by a content update."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - QuarantinedItems: The scan was triggered by newly quarantined items."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - AttachedMedia: The scan was triggered by the attachment of removable media."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - UserLogon: The scan was started due to a user logon."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - ELAM: The scan was triggered by an Early Launch Anti-Malware (ELAM) detection."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The scan type id is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Metadata":{"id":"components/schemas/ocsfv1.6.0Metadata","kind":"json-schema","title":"ocsfv1.6.0Metadata","data":{"title":"ocsfv1.6.0Metadata","type":"object","description":"The Metadata object describes the metadata associated with the event.","properties":{"correlation_uid":{"type":"string","nullable":true,"description":"The unique identifier used to correlate events."},"debug":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Debug information about non-fatal issues with this OCSF event. Each issue is a line in this string array."},"event_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Event ID, Code, or Name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" that the product uses to primarily identify the event."},"children":[],"type":"text"}],"type":"paragraph"}]},"extension":{"$ref":"#/components/schemas/ocsfv1.6.0Extension","nullable":true,"description":"The schema extension used to create the event."},"extensions":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Extension"},"nullable":true,"description":"The schema extensions used to create the event."},"is_truncated":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates whether the OCSF event data has been truncated due to size limitations. When "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", some event data may have been omitted to fit within system constraints."},"children":[],"type":"text"}],"type":"paragraph"}]},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of labels attached to the event. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[\"sample\", \"dev\"]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"log_level":{"type":"string","nullable":true,"description":"The audit level at which an event was generated."},"log_name":{"type":"string","nullable":true,"description":"The event log name. For example, syslog file name or Windows logging subsystem: Security."},"log_provider":{"type":"string","nullable":true,"description":"The logging provider or logging service that logged the event. For example, Microsoft-Windows-Security-Auditing."},"log_version":{"type":"string","nullable":true,"description":"The event log schema version that specifies the format of the original event. For example syslog version or Cisco Log Schema Version."},"logged_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The time when the logging system collected and logged the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different."},"children":[],"type":"text"}]},"logged_time_dt":{"type":"string","format":"date-time","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The time when the logging system collected and logged the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different."},"children":[],"type":"text"}]},"loggers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Logger"},"nullable":true,"description":"An array of Logger objects that describe the devices and logging products between the event source and its eventual destination. Note, this attribute can be used when there is a complex end-to-end path of event flow."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the event was last modified or enriched."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the event was last modified or enriched."},"original_time":{"type":"string","nullable":true,"description":"The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs."},"processed_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The event processed time, such as an ETL operation."},"processed_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The event processed time, such as an ETL operation."},"product":{"$ref":"#/components/schemas/ocsfv1.6.0Product","description":"The product that reported the event."},"profiles":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of profiles used to create the event.  Profiles should be referenced by their "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for core profiles, or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"extension/name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for profiles from extensions."},"children":[],"type":"text"}],"type":"paragraph"}]},"sequence":{"type":"integer","nullable":true,"description":"Sequence number of the event. The sequence number is a value available in some events, to make the exact ordering of events unambiguous, regardless of the event time precision."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the event."},"children":[],"type":"text"}],"type":"paragraph"}]},"tenant_uid":{"type":"string","nullable":true,"description":"The unique tenant identifier."},"transformation_info_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0TransformationInfo"},"nullable":true,"description":"An array of transformation info that describes the mappings or transforms applied to the data."},"uid":{"type":"string","nullable":true,"description":"The logging system-assigned unique identifier of an event instance."},"untruncated_size":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The original size of the OCSF event data in kilobytes before any truncation occurred. This field is typically populated when "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"is_truncated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to indicate the full size of the original event."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The version of the OCSF schema, using Semantic Versioning Specification ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://semver.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SemVer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.0.0."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Event consumers use the version to determine the available event attributes."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["product","version"]}},"components/schemas/ocsfv1.6.0Metric":{"id":"components/schemas/ocsfv1.6.0Metric","kind":"json-schema","title":"ocsfv1.6.0Metric","data":{"title":"ocsfv1.6.0Metric","type":"object","description":"The Metric object defines a simple name/value pair entity for a metric.","properties":{"name":{"type":"string","description":"The name of the metric."},"value":{"type":"string","description":"The value of the metric."}},"required":["name","value"]}},"components/schemas/ocsfv1.6.0Mitigation":{"id":"components/schemas/ocsfv1.6.0Mitigation","kind":"json-schema","title":"ocsfv1.6.0Mitigation","data":{"title":"ocsfv1.6.0Mitigation","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE Mitigation object describes the ATT&CK® or ATLAS™ Mitigation ID and/or name that is associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"countermeasures":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0D3fend"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The D3FEND countermeasures that are associated with the attack technique. For example: ATT&CK Technique "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"T1003"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is addressed by Mitigation "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"M1027"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", and D3FEND Technique "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"D3-OTP"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Mitigation name that is associated with the attack technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Password Policies"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Code Signing"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The versioned permalink of the Mitigation. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://attack.mitre.org/versions/v14/mitigations/M1027"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Mitigation ID that is associated with the attack technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"M1027"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AML.M0013"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.6.0NetworkConnectionInfo":{"id":"components/schemas/ocsfv1.6.0NetworkConnectionInfo","kind":"json-schema","title":"ocsfv1.6.0NetworkConnectionInfo","data":{"title":"ocsfv1.6.0NetworkConnectionInfo","type":"object","description":"The Network Connection Information object describes characteristics of an OSI Transport Layer communication, including TCP and UDP.","properties":{"boundary":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The boundary of the connection, normalized to the caption of 'boundary_id'. In the case of 'Other', it is defined by the event source. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" For cloud connections, this translates to the traffic-boundary(same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"boundary_id":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkConnectionInfo_BoundaryId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the boundary of the connection. "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":" For cloud connections, this translates to the traffic-boundary (same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External."},"children":[],"type":"text"}],"type":"tag","tag":"html"}]},"community_uid":{"type":"string","nullable":true,"description":"The Community ID of the network connection."},"direction":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The direction of the initiated connection, traffic, or email, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"direction_id":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkConnectionInfo_DirectionId","description":"The normalized identifier of the direction of the initiated connection, traffic, or email."},"flag_history":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Connection Flag History summarizes events in a network connection. For example flags "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" ShAD "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" representing SYN, SYN/ACK, ACK and Data exchange."},"children":[],"type":"text"}],"type":"paragraph"}]},"protocol_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The IP protocol name in lowercase, as defined by the Internet Assigned Numbers Authority (IANA). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tcp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"udp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"protocol_num":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The IP protocol number, as defined by the Internet Assigned Numbers Authority (IANA). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"6"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for TCP and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"17"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for UDP."},"children":[],"type":"text"}],"type":"paragraph"}]},"protocol_ver":{"type":"string","nullable":true,"description":"The Internet Protocol version."},"protocol_ver_id":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkConnectionInfo_ProtocolVerId","nullable":true,"description":"The Internet Protocol version identifier."},"session":{"$ref":"#/components/schemas/ocsfv1.6.0Session","nullable":true,"description":"The authenticated user or service session."},"tcp_flags":{"type":"integer","nullable":true,"description":"The network connection TCP header flags (i.e., control bits)."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the connection."}},"required":["direction_id"]}},"components/schemas/ocsfv1.6.0NetworkConnectionInfo_BoundaryId":{"id":"components/schemas/ocsfv1.6.0NetworkConnectionInfo_BoundaryId","kind":"json-schema","title":"ocsfv1.6.0NetworkConnectionInfo_BoundaryId","data":{"title":"ocsfv1.6.0NetworkConnectionInfo_BoundaryId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkConnectionInfoBoundaryId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The connection boundary is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Localhost: Local network traffic on the same endpoint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Internal: Internal network traffic between two endpoints inside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - External: External network traffic between two endpoints on the Internet or outside the network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - SameVPC: Through another resource in the same VPC"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - VPCGateway: Through an Internet gateway or a gateway VPC endpoint"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - VirtualPrivateGateway: Through a virtual private gateway"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - regionVPC: Through an intra-region VPC peering connection"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - regionVPC: Through an inter-region VPC peering connection"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - LocalGateway: Through a local gateway"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - GatewayVPC: Through a gateway VPC endpoint (Nitro-based instances only)"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - InternetGateway: Through an Internet gateway (Nitro-based instances only)"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The boundary is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"boundary"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0NetworkConnectionInfo_DirectionId":{"id":"components/schemas/ocsfv1.6.0NetworkConnectionInfo_DirectionId","kind":"json-schema","title":"ocsfv1.6.0NetworkConnectionInfo_DirectionId","data":{"title":"ocsfv1.6.0NetworkConnectionInfo_DirectionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkConnectionInfoDirectionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The connection direction is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Inbound: Inbound network connection. The connection was originated from the Internet or outside network, destined for services on the inside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Outbound: Outbound network connection. The connection was originated from inside the network, destined for services on the Internet or outside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Lateral: Lateral network connection. The connection was originated from inside the network, destined for services on the inside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The direction is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"direction"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0NetworkConnectionInfo_ProtocolVerId":{"id":"components/schemas/ocsfv1.6.0NetworkConnectionInfo_ProtocolVerId","kind":"json-schema","title":"ocsfv1.6.0NetworkConnectionInfo_ProtocolVerId","data":{"title":"ocsfv1.6.0NetworkConnectionInfo_ProtocolVerId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkConnectionInfoProtocolVerId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The protocol version is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - IPv4_"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - IPv6_"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The protocol version is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"protocol_ver"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0NetworkEndpoint":{"id":"components/schemas/ocsfv1.6.0NetworkEndpoint","kind":"json-schema","title":"ocsfv1.6.0NetworkEndpoint","data":{"title":"ocsfv1.6.0NetworkEndpoint","type":"object","description":"The Network Endpoint object describes characteristics of a network endpoint. These can be a source or destination of a network connection.","properties":{"agent_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Agent"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"agent"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects associated with a device, endpoint, or resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"autonomous_system":{"$ref":"#/components/schemas/ocsfv1.6.0AutonomousSystem","nullable":true,"description":"The Autonomous System details associated with an IP address."},"container":{"$ref":"#/components/schemas/ocsfv1.6.0Container","nullable":true,"description":"The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd."},"domain":{"type":"string","nullable":true,"description":"The name of the domain that the endpoint belongs to or that corresponds to the endpoint."},"hostname":{"$ref":"#/components/schemas/ocsfv1.6.0Hostname","nullable":true,"description":"The fully qualified name of the endpoint."},"hw_info":{"$ref":"#/components/schemas/ocsfv1.6.0DeviceHwInfo","nullable":true,"description":"The endpoint hardware information."},"instance_uid":{"type":"string","nullable":true,"description":"The unique identifier of a VM instance."},"interface_name":{"type":"string","nullable":true,"description":"The name of the network interface (e.g. eth2)."},"interface_uid":{"type":"string","nullable":true,"description":"The unique identifier of the network interface."},"intermediate_ips":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0IPAddress"},"nullable":true,"description":"The intermediate IP Addresses. For example, the IP addresses in the HTTP X-Forwarded-For header."},"ip":{"$ref":"#/components/schemas/ocsfv1.6.0IPAddress","nullable":true,"description":"The IP address of the endpoint, in either IPv4 or IPv6 format."},"isp":{"type":"string","nullable":true,"description":"The name of the Internet Service Provider (ISP)."},"isp_org":{"type":"string","nullable":true,"description":"The organization name of the Internet Service Provider (ISP). This represents the parent organization or company that owns/operates the ISP. For example, Comcast Corporation would be the ISP org for Xfinity internet service. This attribute helps identify the ultimate provider when ISPs operate under different brand names."},"location":{"$ref":"#/components/schemas/ocsfv1.6.0Location","nullable":true,"description":"The geographical location of the endpoint."},"mac":{"$ref":"#/components/schemas/ocsfv1.6.0MACAddress","nullable":true,"description":"The Media Access Control (MAC) address of the endpoint."},"name":{"type":"string","nullable":true,"description":"The short name of the endpoint."},"namespace_pid":{"type":"integer","nullable":true,"description":"If running under a process namespace (such as in a container), the process identifier within that process namespace."},"os":{"$ref":"#/components/schemas/ocsfv1.6.0Os","nullable":true,"description":"The endpoint operating system."},"owner":{"$ref":"#/components/schemas/ocsfv1.6.0User","nullable":true,"description":"The identity of the service or user account that owns the endpoint or was last logged into it."},"port":{"$ref":"#/components/schemas/ocsfv1.6.0Port","nullable":true,"description":"The port used for communication within the network connection."},"proxy_endpoint":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkProxy","nullable":true,"description":"The network proxy information pertaining to a specific endpoint. This can be used to describe information pertaining to network address translation (NAT)."},"subnet_uid":{"type":"string","nullable":true,"description":"The unique identifier of a virtual subnet."},"svc_name":{"type":"string","nullable":true,"description":"The service name in service-to-service connections. For example, AWS VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields identify the connection is coming from or going to an AWS service."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network endpoint type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"unknown"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkEndpoint_TypeId","nullable":true,"description":"The network endpoint type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the endpoint."},"vlan_uid":{"type":"string","nullable":true,"description":"The Virtual LAN identifier."},"vpc_uid":{"type":"string","nullable":true,"description":"The unique identifier of the Virtual Private Cloud (VPC)."},"zone":{"type":"string","nullable":true,"description":"The network zone or LAN segment."}}}},"components/schemas/ocsfv1.6.0NetworkEndpoint_TypeId":{"id":"components/schemas/ocsfv1.6.0NetworkEndpoint_TypeId","kind":"json-schema","title":"ocsfv1.6.0NetworkEndpoint_TypeId","data":{"title":"ocsfv1.6.0NetworkEndpoint_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkEndpointTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Server: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Server/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Desktop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Laptop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Tablet: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Mobile: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile phone"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Virtual: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual machine"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - IOT: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.techtarget.com/iotagenda/definition/IoT-device"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IOT (Internet of Things) device"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Browser: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Browser/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"web browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Firewall: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Firewall/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking firewall"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Switch: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Switch/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking switch"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Hub: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Ethernet_hub"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking hub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - Router: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Router/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking router"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - IDS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion detection system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - IPS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion prevention system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - LoadBalancer: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Load_balancing_(computing)"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Load Balancer device."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0NetworkInterface":{"id":"components/schemas/ocsfv1.6.0NetworkInterface","kind":"json-schema","title":"ocsfv1.6.0NetworkInterface","data":{"title":"ocsfv1.6.0NetworkInterface","type":"object","description":"The Network Interface object describes the type and associated attributes of a physical or virtual network interface.","properties":{"hostname":{"$ref":"#/components/schemas/ocsfv1.6.0Hostname","nullable":true,"description":"The hostname associated with the network interface."},"ip":{"$ref":"#/components/schemas/ocsfv1.6.0IPAddress","nullable":true,"description":"The IP address associated with the network interface."},"ip_addresses":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of IP addresses available on the network interface."},"mac":{"$ref":"#/components/schemas/ocsfv1.6.0MACAddress","nullable":true,"description":"The MAC address of the network interface."},"mac_addresses":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of MAC addresses available on the network interface."},"name":{"type":"string","nullable":true,"description":"The name of the network interface."},"namespace":{"type":"string","nullable":true,"description":"The namespace is useful in merger or acquisition situations. For example, when similar entities exist that you need to keep separate."},"open_ports":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0PortInfo"},"nullable":true,"description":"The list of open ports on a network interface, including port numbers and associated protocol information."},"subnet_prefix":{"type":"integer","nullable":true,"description":"The subnet prefix length determines the number of bits used to represent the network part of the IP address. The remaining bits are reserved for identifying individual hosts within that subnet."},"type":{"type":"string","nullable":true,"description":"The type of network interface."},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkInterface_TypeId","nullable":true,"description":"The network interface type identifier."},"uid":{"type":"string","nullable":true,"description":"The unique identifier for the network interface."}}}},"components/schemas/ocsfv1.6.0NetworkInterface_TypeId":{"id":"components/schemas/ocsfv1.6.0NetworkInterface_TypeId","kind":"json-schema","title":"ocsfv1.6.0NetworkInterface_TypeId","data":{"title":"ocsfv1.6.0NetworkInterface_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkInterfaceTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Wired"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Wireless"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Mobile"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Tunnel"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0NetworkProxy":{"id":"components/schemas/ocsfv1.6.0NetworkProxy","kind":"json-schema","title":"ocsfv1.6.0NetworkProxy","data":{"title":"ocsfv1.6.0NetworkProxy","type":"object","description":"The network proxy endpoint object describes a proxy server, which acts as an intermediary between a client requesting a resource and the server providing that resource.","properties":{"agent_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Agent"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"agent"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects associated with a device, endpoint, or resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"autonomous_system":{"$ref":"#/components/schemas/ocsfv1.6.0AutonomousSystem","nullable":true,"description":"The Autonomous System details associated with an IP address."},"container":{"$ref":"#/components/schemas/ocsfv1.6.0Container","nullable":true,"description":"The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd."},"domain":{"type":"string","nullable":true,"description":"The name of the domain that the endpoint belongs to or that corresponds to the endpoint."},"hostname":{"$ref":"#/components/schemas/ocsfv1.6.0Hostname","nullable":true,"description":"The fully qualified name of the endpoint."},"hw_info":{"$ref":"#/components/schemas/ocsfv1.6.0DeviceHwInfo","nullable":true,"description":"The endpoint hardware information."},"instance_uid":{"type":"string","nullable":true,"description":"The unique identifier of a VM instance."},"interface_name":{"type":"string","nullable":true,"description":"The name of the network interface (e.g. eth2)."},"interface_uid":{"type":"string","nullable":true,"description":"The unique identifier of the network interface."},"intermediate_ips":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0IPAddress"},"nullable":true,"description":"The intermediate IP Addresses. For example, the IP addresses in the HTTP X-Forwarded-For header."},"ip":{"$ref":"#/components/schemas/ocsfv1.6.0IPAddress","nullable":true,"description":"The IP address of the endpoint, in either IPv4 or IPv6 format."},"isp":{"type":"string","nullable":true,"description":"The name of the Internet Service Provider (ISP)."},"isp_org":{"type":"string","nullable":true,"description":"The organization name of the Internet Service Provider (ISP). This represents the parent organization or company that owns/operates the ISP. For example, Comcast Corporation would be the ISP org for Xfinity internet service. This attribute helps identify the ultimate provider when ISPs operate under different brand names."},"location":{"$ref":"#/components/schemas/ocsfv1.6.0Location","nullable":true,"description":"The geographical location of the endpoint."},"mac":{"$ref":"#/components/schemas/ocsfv1.6.0MACAddress","nullable":true,"description":"The Media Access Control (MAC) address of the endpoint."},"name":{"type":"string","nullable":true,"description":"The short name of the endpoint."},"namespace_pid":{"type":"integer","nullable":true,"description":"If running under a process namespace (such as in a container), the process identifier within that process namespace."},"os":{"$ref":"#/components/schemas/ocsfv1.6.0Os","nullable":true,"description":"The endpoint operating system."},"owner":{"$ref":"#/components/schemas/ocsfv1.6.0User","nullable":true,"description":"The identity of the service or user account that owns the endpoint or was last logged into it."},"port":{"$ref":"#/components/schemas/ocsfv1.6.0Port","nullable":true,"description":"The port used for communication within the network connection."},"proxy_endpoint":{"$ref":"#/components/schemas/ocsfv1.6.0Object","nullable":true,"description":"The network proxy information pertaining to a specific endpoint. This can be used to describe information pertaining to network address translation (NAT)."},"subnet_uid":{"type":"string","nullable":true,"description":"The unique identifier of a virtual subnet."},"svc_name":{"type":"string","nullable":true,"description":"The service name in service-to-service connections. For example, AWS VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields identify the connection is coming from or going to an AWS service."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network endpoint type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"unknown"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0NetworkProxy_TypeId","nullable":true,"description":"The network endpoint type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the endpoint."},"vlan_uid":{"type":"string","nullable":true,"description":"The Virtual LAN identifier."},"vpc_uid":{"type":"string","nullable":true,"description":"The unique identifier of the Virtual Private Cloud (VPC)."},"zone":{"type":"string","nullable":true,"description":"The network zone or LAN segment."}}}},"components/schemas/ocsfv1.6.0NetworkProxy_TypeId":{"id":"components/schemas/ocsfv1.6.0NetworkProxy_TypeId","kind":"json-schema","title":"ocsfv1.6.0NetworkProxy_TypeId","data":{"title":"ocsfv1.6.0NetworkProxy_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkProxyTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Server: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Server/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Desktop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Laptop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Tablet: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Mobile: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile phone"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Virtual: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual machine"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - IOT: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.techtarget.com/iotagenda/definition/IoT-device"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IOT (Internet of Things) device"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Browser: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Browser/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"web browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Firewall: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Firewall/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking firewall"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Switch: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Switch/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking switch"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Hub: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Ethernet_hub"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking hub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - Router: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Router/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking router"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - IDS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion detection system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - IPS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion prevention system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - LoadBalancer: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Load_balancing_(computing)"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Load Balancer device."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0NetworkTraffic":{"id":"components/schemas/ocsfv1.6.0NetworkTraffic","kind":"json-schema","title":"ocsfv1.6.0NetworkTraffic","data":{"title":"ocsfv1.6.0NetworkTraffic","type":"object","description":"The Network Traffic object describes characteristics of network traffic. Network traffic refers to data moving across a network at a given point of time.","properties":{"bytes":{"type":"integer","nullable":true,"description":"The total number of bytes (in and out)."},"bytes_in":{"type":"integer","nullable":true,"description":"The number of bytes sent from the destination to the source."},"bytes_missed":{"type":"integer","nullable":true,"description":"Indicates the number of bytes missed, which is representative of packet loss."},"bytes_out":{"type":"integer","nullable":true,"description":"The number of bytes sent from the source to the destination."},"chunks":{"type":"integer","nullable":true,"description":"The total number of chunks (in and out)."},"chunks_in":{"type":"integer","nullable":true,"description":"The number of chunks sent from the destination to the source."},"chunks_out":{"type":"integer","nullable":true,"description":"The number of chunks sent from the source to the destination."},"packets":{"type":"integer","nullable":true,"description":"The total number of packets (in and out)."},"packets_in":{"type":"integer","nullable":true,"description":"The number of packets sent from the destination to the source."},"packets_out":{"type":"integer","nullable":true,"description":"The number of packets sent from the source to the destination."}}}},"components/schemas/ocsfv1.6.0Object":{"id":"components/schemas/ocsfv1.6.0Object","kind":"json-schema","title":"ocsfv1.6.0Object","data":{"title":"ocsfv1.6.0Object","type":"object","additionalProperties":true,"description":"An unordered collection of attributes. It defines a set of attributes available in all objects. It can be also used as a generic object to log objects that are not otherwise defined by the schema."}},"components/schemas/ocsfv1.6.0Observable":{"id":"components/schemas/ocsfv1.6.0Observable","kind":"json-schema","title":"ocsfv1.6.0Observable","data":{"title":"ocsfv1.6.0Observable","type":"object","description":"The observable object is a pivot element that contains related information found in many places in the event.","properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full name of the observable attribute. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is a pointer/reference to an attribute within the OCSF event data. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"file.name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"reputation":{"$ref":"#/components/schemas/ocsfv1.6.0Reputation","nullable":true,"description":"Contains the original and normalized reputation scores."},"type":{"type":"string","nullable":true,"description":"The observable value type name."},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0Observable_TypeId","description":"The observable value type identifier."},"value":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The value associated with the observable attribute. The meaning of the value depends on the observable type."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" refers to a scalar attribute, then the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is the value of the attribute."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" refers to an object attribute, then the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is not populated."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["type_id"]}},"components/schemas/ocsfv1.6.0Observable_TypeId":{"id":"components/schemas/ocsfv1.6.0Observable_TypeId","kind":"json-schema","title":"ocsfv1.6.0Observable_TypeId","data":{"title":"ocsfv1.6.0Observable_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ObservableTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: Unknown observable data type."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Hostname: Unique name assigned to a device connected to a computer network. It may be a fully qualified domain name (FQDN). For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"r2-d2.example.com."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":","},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mx.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or IPv6 format. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"192.168.200.24"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2001:0db8:85a3:0000:0000:8a2e:0370:7334"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - MACAddress: Media Access Control (MAC) address. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"18:36:F3:98:4F:9A"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - UserName: User name. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"john_doe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - EmailAddress: Email address. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"john_doe@example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - URLString: Uniform Resource Locator (URL) string. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http://www.example.com/download/trouble.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - FileName: File name. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"text-file.txt"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Hash: Hash. A unique value that corresponds to the content of the file, image, ja3_hash or hassh found in the schema. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" MD5: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3172ac7e2b55cbb81f04a6e65855a628"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - ProcessName: Process name. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notepad"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - ResourceUID: Resource unique identifier. For example, S3 Bucket name or EC2 Instance ID."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Port: The TCP/UDP port number. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"80"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":","},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"22"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - Subnet: The subnet represented in a CIDR notation, using the format network_address/prefix_length. The network_address can be in either IPv4 or IPv6 format. The prefix length indicates the number of bits used for the network portion, and the remaining bits are available for host addresses within that subnet. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"192.168.1.0/24"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":","},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2001:0db8:85a3:0000::/64"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Endpoint: The Endpoint object describes a physical or virtual device that connects to and exchanges information with a computer network. Some examples of endpoints are mobile devices, desktop computers, virtual machines, embedded devices, and servers. Internet-of-Things devices—like cameras, lighting, refrigerators, security systems, smart speakers, and thermostats—are also endpoints."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - User: The User object describes the characteristics of a user/person or a security principal."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Email: The Email object describes the email metadata such as sender, recipients, and direction, and can include embedded URLs and files."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - UniformResourceLocator: The Uniform Resource Locator (URL) object describes the characteristics of a URL."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - File: The File object represents the metadata associated with a file stored in a computer system. It encompasses information about the file itself, including its attributes, properties, and organizational details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Process: The Process object describes a running instance of a launched program."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - GeoLocation: The Geo Location object describes a geographical location, usually associated with an IP address."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Container: The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"30 - Fingerprint: The Fingerprint object provides detailed information about a digital fingerprint, which is a compact representation of data used to identify a longer piece of information, such as a public key or file content. It contains the algorithm and value of the fingerprint, enabling efficient and reliable identification of the associated data."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"45 - FilePath: The full path to the file. For example: For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"c:\\windows\\system32\\svchost.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The observable data type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which may contain data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Organization":{"id":"components/schemas/ocsfv1.6.0Organization","kind":"json-schema","title":"ocsfv1.6.0Organization","data":{"title":"ocsfv1.6.0Organization","type":"object","description":"The Organization object describes characteristics of an organization or company and its division if any. Additionally, it also describes cloud and Software-as-a-Service (SaaS) logical hierarchies such as AWS Organizations, Google Cloud Organizations, Oracle Cloud Tenancies, and similar constructs.","properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the organization, Oracle Cloud Tenancy, Google Cloud Organization, or AWS Organization. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Widget, Inc. "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" AWS Organization name "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"ou_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of an organizational unit, Google Cloud Folder, or AWS Org Unit. For example, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" GCP Project Name "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Dev_Prod_OU "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"ou_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of an organizational unit, Google Cloud Folder, or AWS Org Unit. For example, an  "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Oracle Cloud Tenancy ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" AWS OU ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" GCP Folder ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the organization, Oracle Cloud Tenancy, Google Cloud Organization, or AWS Organization. For example, an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" AWS Org ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Oracle Cloud Domain ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.6.0Os":{"id":"components/schemas/ocsfv1.6.0Os","kind":"json-schema","title":"ocsfv1.6.0Os","data":{"title":"ocsfv1.6.0Os","type":"object","description":"The Operating System (OS) object describes characteristics of an OS, such as Linux or Windows.","properties":{"build":{"type":"string","nullable":true,"description":"The operating system build number."},"country":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The operating system country code, as defined by the ISO 3166-1 standard (Alpha-2 code)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" The two letter country code should be capitalized. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"US"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CA"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"cpe_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Platform Enumeration (CPE) name as described by ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://nvd.nist.gov/products/cpe"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpe:/a:apple:safari:16.2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_bits":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cpu architecture, the number of bits used for addressing in memory. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"32"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"64"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"edition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The operating system edition. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Professional"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"kernel_release":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The kernel release of the operating system. On Unix-based systems, this is determined from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"uname -r"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" command output, for example \"5.15.0-122-generic\"."},"children":[],"type":"text"}],"type":"paragraph"}]},"lang":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The two letter lower case language codes, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/ISO_639-1"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ISO 639-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"en"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (English), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"de"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (German), or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"fr"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (French)."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","description":"The operating system name."},"sp_name":{"type":"string","nullable":true,"description":"The name of the latest Service Pack."},"sp_ver":{"type":"integer","nullable":true,"description":"The version number of the latest Service Pack."},"type":{"type":"string","nullable":true,"description":"The type of the operating system."},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0Os_TypeId","description":"The type identifier of the operating system."},"version":{"type":"string","nullable":true,"description":"The version of the OS running on the device that originated the event. For example: \"Windows 10\", \"OS X 10.7\", or \"iOS 9\"."}},"required":["name","type_id"]}},"components/schemas/ocsfv1.6.0Os_TypeId":{"id":"components/schemas/ocsfv1.6.0Os_TypeId","kind":"json-schema","title":"ocsfv1.6.0Os_TypeId","data":{"title":"ocsfv1.6.0Os_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OsTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"100 - Windows"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"101 - WindowsMobile"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"200 - Linux"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"201 - Android"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"300 - macOS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"301 - iOS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"302 - iPadOS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400 - Solaris"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"401 - AIX"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"402 - UX"},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Osint":{"id":"components/schemas/ocsfv1.6.0Osint","kind":"json-schema","title":"ocsfv1.6.0Osint","data":{"title":"ocsfv1.6.0Osint","type":"object","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","properties":{"answers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0DnsAnswer"},"nullable":true,"description":"Any pertinent DNS answers information related to an indicator or OSINT analysis."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK Tactics, Techniques, and/or Procedures (TTPs) pertinent to an indicator or OSINT analysis."},"children":[],"type":"text"}],"type":"paragraph"}]},"autonomous_system":{"$ref":"#/components/schemas/ocsfv1.6.0AutonomousSystem","nullable":true,"description":"Any pertinent autonomous system information related to an indicator or OSINT analysis."},"campaign":{"$ref":"#/components/schemas/ocsfv1.6.0Campaign","nullable":true,"description":"The campaign object describes details about the campaign that was the source of the activity."},"category":{"type":"string","nullable":true,"description":"Categorizes the threat indicator based on its functional or operational role."},"comment":{"type":"string","nullable":true,"description":"Analyst commentary or source commentary about an indicator or OSINT analysis."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence of an indicator being malicious and/or pertinent, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source or analyst."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.6.0Osint_ConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of collected information related to the OSINT or how pertinent an indicator or analysis is to a specific event or finding. A low confidence means that the information collected or analysis conducted lacked detail or is not accurate enough to qualify an indicator as fully malicious."},"created_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The timestamp when the indicator was initially created or identified."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the indicator was initially created or identified."},"creator":{"$ref":"#/components/schemas/ocsfv1.6.0User","nullable":true,"description":"The identifier of the user, system, or organization that contributed the indicator."},"desc":{"type":"string","nullable":true,"description":"A detailed explanation of the indicator, including its context, purpose, and relevance."},"detection_pattern":{"type":"string","nullable":true,"description":"The specific detection pattern or signature associated with the indicator."},"detection_pattern_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The detection pattern type, normalized to the caption of the detection_pattern_type_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"detection_pattern_type_id":{"$ref":"#/components/schemas/ocsfv1.6.0Osint_DetectionPatternTypeId","nullable":true,"description":"Specifies the type of detection pattern used to identify the associated threat indicator."},"email":{"$ref":"#/components/schemas/ocsfv1.6.0Email","nullable":true,"description":"Any email information pertinent to an indicator or OSINT analysis."},"email_auth":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAuth","nullable":true,"description":"Any email authentication information pertinent to an indicator or OSINT analysis."},"expiration_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The expiration date of the indicator, after which it is no longer considered reliable."},"expiration_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The expiration date of the indicator, after which it is no longer considered reliable."},"external_uid":{"type":"string","nullable":true,"description":"A unique identifier assigned by an external system for cross-referencing."},"file":{"$ref":"#/components/schemas/ocsfv1.6.0File","nullable":true,"description":"Any pertinent file information related to an indicator or OSINT analysis."},"intrusion_sets":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A grouping of adversarial behaviors and resources believed to be associated with specific threat actors or campaigns. Intrusion sets often encompass multiple campaigns and are used to organize related activities under a common label."},"kill_chain":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0KillChainPhase"},"nullable":true,"description":"Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT analysis."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Tags or keywords associated with the indicator to enhance searchability."},"location":{"$ref":"#/components/schemas/ocsfv1.6.0Location","nullable":true,"description":"Any pertinent geolocation information related to an indicator or OSINT analysis."},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The timestamp of the last modification or update to the indicator."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp of the last modification or update to the indicator."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is a pointer/reference to an attribute within the OCSF event data. For example: file.name."},"children":[],"type":"text"}],"type":"paragraph"}]},"references":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Provides a reference to an external source of information related to the CTI being represented. This may include a URL, a document, or some other type of reference that provides additional context or information about the CTI."},"related_analytics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Analytic"},"nullable":true,"description":"Any analytics related to an indicator or OSINT analysis."},"reputation":{"$ref":"#/components/schemas/ocsfv1.6.0Reputation","nullable":true,"description":"Related reputational analysis from third-party engines and analysts for a given indicator or OSINT analysis."},"risk_score":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A numerical representation of the threat indicator’s risk level."},"children":[],"type":"text"}],"type":"paragraph"}]},"script":{"$ref":"#/components/schemas/ocsfv1.6.0Script","nullable":true,"description":"Any pertinent script information related to an indicator or OSINT analysis."},"severity":{"type":"string","nullable":true,"description":"Represents the severity level of the threat indicator, typically reflecting its potential impact or damage."},"severity_id":{"$ref":"#/components/schemas/ocsfv1.6.0Osint_SeverityId","nullable":true,"description":"The normalized severity level of the threat indicator, typically reflecting its potential impact or damage."},"signatures":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0DigitalSignature"},"nullable":true,"description":"Any digital signatures or hashes related to an indicator or OSINT analysis."},"src_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":"The source URL of an indicator or OSINT analysis, e.g., a URL back to a TIP, report, or otherwise."},"subdomains":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Any pertinent subdomain information - such as those generated by a Domain Generation Algorithm - related to an indicator or OSINT analysis."},"subnet":{"$ref":"#/components/schemas/ocsfv1.6.0Subnet","nullable":true,"description":"A CIDR or network block related to an indicator or OSINT analysis."},"threat_actor":{"$ref":"#/components/schemas/ocsfv1.6.0ThreatActor","nullable":true,"description":"A threat actor is an individual or group that conducts malicious cyber activities, often with financial, political, or ideological motives."},"tlp":{"$ref":"#/components/schemas/ocsfv1.6.0Osint_Tlp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/tlp/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Traffic Light Protocol"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" was created to facilitate greater sharing of potentially sensitive information and more effective collaboration. TLP provides a simple and intuitive schema for indicating with whom potentially sensitive information can be shared."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":"The OSINT indicator type."},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0Osint_TypeId","description":"The OSINT indicator type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier for the OSINT object."},"uploaded_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The timestamp indicating when the associated indicator or intelligence was added to the system or repository."},"uploaded_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp indicating when the associated indicator or intelligence was added to the system or repository."},"value":{"type":"string","description":"The actual indicator value in scope, e.g., a SHA-256 hash hexdigest or a domain name."},"vendor_name":{"type":"string","nullable":true,"description":"The vendor name of a tool which generates intelligence or provides indicators."},"vulnerabilities":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Vulnerability"},"nullable":true,"description":"Any vulnerabilities related to an indicator or OSINT analysis."},"whois":{"$ref":"#/components/schemas/ocsfv1.6.0Whois","nullable":true,"description":"Any pertinent WHOIS information related to an indicator or OSINT analysis."}},"required":["type_id","value"]}},"components/schemas/ocsfv1.6.0Osint_ConfidenceId":{"id":"components/schemas/ocsfv1.6.0Osint_ConfidenceId","kind":"json-schema","title":"ocsfv1.6.0Osint_ConfidenceId","data":{"title":"ocsfv1.6.0Osint_ConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OsintConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Osint_DetectionPatternTypeId":{"id":"components/schemas/ocsfv1.6.0Osint_DetectionPatternTypeId","kind":"json-schema","title":"ocsfv1.6.0Osint_DetectionPatternTypeId","data":{"title":"ocsfv1.6.0Osint_DetectionPatternTypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OsintDetectionPatternTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is not mapped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - STIX"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - PCRE"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - SIGMA"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Snort"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Suricata"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - YARA"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The detection pattern type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"detection_pattern_type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Osint_SeverityId":{"id":"components/schemas/ocsfv1.6.0Osint_SeverityId","kind":"json-schema","title":"ocsfv1.6.0Osint_SeverityId","data":{"title":"ocsfv1.6.0Osint_SeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OsintSeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Osint_Tlp":{"id":"components/schemas/ocsfv1.6.0Osint_Tlp","kind":"json-schema","title":"ocsfv1.6.0Osint_Tlp","data":{"title":"ocsfv1.6.0Osint_Tlp","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OsintTlp is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only spread this on a need-to-know basis within their organization and its clients. Note that TLP:AMBER+STRICT restricts sharing to the organization only. Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risk to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may share TLP:AMBER information with members of their own organization and its clients, but only on a need-to-know basis to protect their organization and its clients and prevent further harm. Note: if the source wants to restrict sharing to the organization only, they must specify TLP:AMBER+STRICT."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure, recipients can only spread this on a need-to-know basis within their organization and its clients. Note that TLP:AMBER+STRICT restricts sharing to the organization only. Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risk to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may share TLP:AMBER information with members of their own organization and its clients, but only on a need-to-know basis to protect their organization and its clients and prevent further harm. Note: if the source wants to restrict sharing to the organization only, they must specify TLP:AMBER+STRICT."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the world, there is no limit on disclosure. Sources may use TLP:CLEAR when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be shared without restriction."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can spread this within their community. Sources may use TLP:GREEN when information is useful to increase awareness within their wider community. Recipients may share TLP:GREEN information with peers and partner organizations within their community, but not via publicly accessible channels. TLP:GREEN information may not be shared outside of the community. Note: when “community” is not defined, assume the cybersecurity/defense community."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"RED - RED: TLP:RED is for the eyes and ears of individual recipients only, no further disclosure. Sources may use TLP:RED when information cannot be effectively acted upon without significant risk for the privacy, reputation, or operations of the organizations involved. Recipients may therefore not share TLP:RED information with anyone else. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"WHITE - WHITE: TLP:WHITE and TLP:CLEAR may be used interchangeably, TLP:WHITE is the most up to date (as of TLP 2.0) usage."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Osint_TypeId":{"id":"components/schemas/ocsfv1.6.0Osint_TypeId","kind":"json-schema","title":"ocsfv1.6.0Osint_TypeId","data":{"title":"ocsfv1.6.0Osint_TypeId","type":"integer","description":"OsintTypeId is an enum, and the following values are allowed.\n0 - Unknown: The indicator type is ambiguous or there is not a related indicator for the OSINT object.\n1 - IPAddress: An IPv4 or IPv6 address.\n2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial domain.\n3 - Hostname: A hostname or computer name.\n4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, SSDEEP, VHASH, etc. generated from a file, malware sample, request header, or otherwise used to identify a pertinent artifact.\n5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator (URI).\n6 - UserAgent: A User Agent typically seen in HTTP request headers.\n7 - DigitalCertificate: The serial number, fingerprint, or full content of an X.509 digital certificate.\n8 - Email: The contents of an email or any related information to an email object.\n9 - EmailAddress: An email address.\n10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a weakness, exploit, bug, or misconfiguration.\n11 - File: A file or metadata about a file.\n12 - RegistryKey: A Windows Registry Key.\n13 - RegistryValue: A Windows Registry Value.\n14 - CommandLine: A partial or full Command Line used to invoke scripts or other remote commands.\n99 - Other: The indicator type is not directly listed."}},"components/schemas/ocsfv1.6.0Package":{"id":"components/schemas/ocsfv1.6.0Package","kind":"json-schema","title":"ocsfv1.6.0Package","data":{"title":"ocsfv1.6.0Package","type":"object","description":"The Software Package object describes details about a software package.","properties":{"architecture":{"type":"string","nullable":true,"description":"Architecture is a shorthand name describing the type of computer hardware the packaged software is meant to run on."},"cpe_name":{"type":"string","nullable":true,"description":"The Common Platform Enumeration (CPE) name for the software package."},"epoch":{"type":"integer","nullable":true,"description":"The software package epoch. Epoch is a way to define weighted dependencies based on version numbers."},"hash":{"$ref":"#/components/schemas/ocsfv1.6.0Fingerprint","nullable":true,"description":"Cryptographic hash to identify the binary instance of a software component. This can include any component such file, package, or library."},"license":{"type":"string","nullable":true,"description":"The software license applied to this package."},"license_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL pointing to the license applied on package or software. This is typically a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LICENSE.md"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" file within a repository."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","description":"The software package name."},"package_manager":{"type":"string","nullable":true,"description":"The software packager manager utilized to manage a package on a system, e.g. npm, yum, dpkg etc."},"package_manager_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL of the package or library at the package manager, or the specific URL or URI of an internal package manager link such as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AWS CodeArtifact"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Artifactory"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"purl":{"type":"string","nullable":true,"description":"A purl is a URL string used to identify and locate a software package in a mostly universal and uniform way across programming languages, package managers, packaging conventions, tools, APIs and databases."},"release":{"type":"string","nullable":true,"description":"Release is the number of times a version of the software has been packaged."},"src_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The link to the specific library or package such as within "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"GitHub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", this is different from the link to the package manager where the library or package is hosted."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of software package, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0Package_TypeId","nullable":true,"description":"The type of software package."},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A unique identifier for the package or library reported by the source tool. E.g., the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"libId"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" within the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"sbom"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field of an OX Security Issue or the SPDX "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"components.*.bom-ref"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor who published the software package."},"version":{"type":"string","description":"The software package version."}},"required":["name","version"]}},"components/schemas/ocsfv1.6.0Package_TypeId":{"id":"components/schemas/ocsfv1.6.0Package_TypeId","kind":"json-schema","title":"ocsfv1.6.0Package_TypeId","data":{"title":"ocsfv1.6.0Package_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"PackageTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Application: An application software package."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - OperatingSystem: An operating system software package."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Policy":{"id":"components/schemas/ocsfv1.6.0Policy","kind":"json-schema","title":"ocsfv1.6.0Policy","data":{"title":"ocsfv1.6.0Policy","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Policy object describes the policies that are applicable. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Policy attributes provide traceability to the operational state of the security product at the time that the event was captured, facilitating forensics, troubleshooting, and policy tuning/adjustments."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"data":{"nullable":true,"description":"Additional data about the policy such as the underlying JSON policy itself or other details."},"desc":{"type":"string","nullable":true,"description":"The description of the policy."},"group":{"$ref":"#/components/schemas/ocsfv1.6.0Group","nullable":true,"description":"The policy group."},"is_applied":{"type":"boolean","nullable":true,"description":"A determination if the content of a policy was applied to a target or request, or not."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The policy name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AdministratorAccess Policy"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The policy type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Identity Policy, Resource Policy, Service Control Policy, etc./code>."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"A unique identifier of the policy instance."},"version":{"type":"string","nullable":true,"description":"The policy version number."}}}},"components/schemas/ocsfv1.6.0PortInfo":{"id":"components/schemas/ocsfv1.6.0PortInfo","kind":"json-schema","title":"ocsfv1.6.0PortInfo","data":{"title":"ocsfv1.6.0PortInfo","type":"object","description":"The Port Information object describes a port and its associated protocol details.","properties":{"port":{"$ref":"#/components/schemas/ocsfv1.6.0Port","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The port number. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"80"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"443"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"22"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"protocol_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The IP protocol name in lowercase, as defined by the Internet Assigned Numbers Authority (IANA). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tcp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"udp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"protocol_num":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The IP protocol number, as defined by the Internet Assigned Numbers Authority (IANA). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"6"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for TCP and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"17"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for UDP."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["port"]}},"components/schemas/ocsfv1.6.0Process":{"id":"components/schemas/ocsfv1.6.0Process","kind":"json-schema","title":"ocsfv1.6.0Process","data":{"title":"ocsfv1.6.0Process","type":"object","description":"The Process object describes a running instance of a launched program.","properties":{"ancestry":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0ProcessEntity"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of Process Entities describing the extended parentage of this process object. Direct parent information should be expressed through the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"parent_process"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute. The first array element is the direct parent of this process object. Subsequent list elements go up the process parentage hierarchy. That is, the array is sorted from newest to oldest process. It is recommended to only populate this field for the top-level process object."},"children":[],"type":"text"}],"type":"paragraph"}]},"auid":{"type":"integer","nullable":true,"description":"The audit user assigned at login by the audit subsystem."},"cmd_line":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full command line used to launch an application, service, process, or job. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ssh user@10.0.0.10"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". If the command line is unavailable or missing, the empty string "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"''"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is to be used."},"children":[],"type":"text"}],"type":"paragraph"}]},"container":{"$ref":"#/components/schemas/ocsfv1.6.0Container","nullable":true,"description":"The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd."},"cpid":{"type":"string","nullable":true,"description":"A unique process identifier that can be assigned deterministically by multiple system data producers."},"created_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the process was created/started."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the process was created/started."},"egid":{"type":"integer","nullable":true,"description":"The effective group under which this process is running."},"environment_variables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0EnvironmentVariable"},"nullable":true,"description":"Environment variables associated with the process."},"euid":{"type":"integer","nullable":true,"description":"The effective user under which this process is running."},"file":{"$ref":"#/components/schemas/ocsfv1.6.0File","nullable":true,"description":"The process file object."},"group":{"$ref":"#/components/schemas/ocsfv1.6.0Group","nullable":true,"description":"The group under which this process is running."},"integrity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The process integrity level, normalized to the caption of the integrity_id value. In the case of 'Other', it is defined by the event source (Windows only)."},"children":[],"type":"text"}],"type":"paragraph"}]},"integrity_id":{"$ref":"#/components/schemas/ocsfv1.6.0Process_IntegrityId","nullable":true,"description":"The normalized identifier of the process integrity level (Windows only)."},"lineage":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0FilePath"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The lineage of the process, represented by a list of paths for each ancestor process. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"['/usr/sbin/sshd', '/usr/bin/bash', '/usr/bin/whoami']"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"loaded_modules":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of loaded module names."},"name":{"$ref":"#/components/schemas/ocsfv1.6.0ProcessName","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The friendly name of the process, for example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notepad++"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"namespace_pid":{"type":"integer","nullable":true,"description":"If running under a process namespace (such as in a container), the process identifier within that process namespace."},"parent_process":{"$ref":"#/components/schemas/ocsfv1.6.0Object","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The parent process of this process object. It is recommended to only populate this field for the top-level process object, to prevent deep nesting. Additional ancestry information can be supplied in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ancestry"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute."},"children":[],"type":"text"}],"type":"paragraph"}]},"path":{"type":"string","nullable":true,"description":"The process file path."},"pid":{"type":"integer","nullable":true,"description":"The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process."},"ptid":{"type":"integer","nullable":true,"description":"The identifier of the process thread associated with the event, as returned by the operating system."},"sandbox":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps."},"children":[],"type":"text"}],"type":"paragraph"}]},"session":{"$ref":"#/components/schemas/ocsfv1.6.0Session","nullable":true,"description":"The user session under which this process is running."},"terminated_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the process was terminated."},"terminated_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the process was terminated."},"tid":{"type":"integer","nullable":true,"description":"The identifier of the thread associated with the event, as returned by the operating system."},"uid":{"type":"string","nullable":true,"description":"A unique identifier for this process assigned by the producer (tool).  Facilitates correlation of a process event with other events for that process."},"user":{"$ref":"#/components/schemas/ocsfv1.6.0User","nullable":true,"description":"The user under which this process is running."},"working_directory":{"type":"string","nullable":true,"description":"The working directory of a process."},"xattributes":{"$ref":"#/components/schemas/ocsfv1.6.0Object","nullable":true,"description":"An unordered collection of zero or more name/value pairs that represent a process extended attribute."}}}},"components/schemas/ocsfv1.6.0Process_IntegrityId":{"id":"components/schemas/ocsfv1.6.0Process_IntegrityId","kind":"json-schema","title":"ocsfv1.6.0Process_IntegrityId","data":{"title":"ocsfv1.6.0Process_IntegrityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ProcessIntegrityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The integrity level is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Untrusted"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - System"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Protected"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The integrity level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"integrity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0ProcessEntity":{"id":"components/schemas/ocsfv1.6.0ProcessEntity","kind":"json-schema","title":"ocsfv1.6.0ProcessEntity","data":{"title":"ocsfv1.6.0ProcessEntity","type":"object","description":"The Process Entity object provides critical fields for referencing a process.","properties":{"cmd_line":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full command line used to launch an application, service, process, or job. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ssh user@10.0.0.10"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". If the command line is unavailable or missing, the empty string "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"''"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is to be used."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpid":{"type":"string","nullable":true,"description":"A unique process identifier that can be assigned deterministically by multiple system data producers."},"created_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the process was created/started."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the process was created/started."},"name":{"$ref":"#/components/schemas/ocsfv1.6.0ProcessName","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The friendly name of the process, for example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notepad++"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"path":{"type":"string","nullable":true,"description":"The process file path."},"pid":{"type":"integer","nullable":true,"description":"The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process."},"uid":{"type":"string","nullable":true,"description":"A unique identifier for this process assigned by the producer (tool).  Facilitates correlation of a process event with other events for that process."}}}},"components/schemas/ocsfv1.6.0Product":{"id":"components/schemas/ocsfv1.6.0Product","kind":"json-schema","title":"ocsfv1.6.0Product","data":{"title":"ocsfv1.6.0Product","type":"object","description":"The Product object describes characteristics of a software product.","properties":{"cpe_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Platform Enumeration (CPE) name as described by ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://nvd.nist.gov/products/cpe"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpe:/a:apple:safari:16.2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"distribution_mode":{"type":"string","nullable":true,"description":"Indicates the source from which the app was installed, such as the app store."},"feature":{"$ref":"#/components/schemas/ocsfv1.6.0Feature","nullable":true,"description":"The feature that reported the event."},"lang":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The two letter lower case language codes, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/ISO_639-1"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ISO 639-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"en"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (English), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"de"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (German), or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"fr"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (French)."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","nullable":true,"description":"The name of the product."},"path":{"type":"string","nullable":true,"description":"The installation path of the product."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the product."},"url_string":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":"The URL pointing towards the product."},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor of the product."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The version of the product, as defined by the event source. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2013.1.3-beta"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"workload":{"type":"string","nullable":true,"description":"The product workload associated with the event."}}}},"components/schemas/ocsfv1.6.0ProgrammaticCredential":{"id":"components/schemas/ocsfv1.6.0ProgrammaticCredential","kind":"json-schema","title":"ocsfv1.6.0ProgrammaticCredential","data":{"title":"ocsfv1.6.0ProgrammaticCredential","type":"object","description":"The Programmatic Credential object describes service-specific credentials used for direct API access and system integration. These credentials are typically issued by individual services or platforms for accessing their APIs and resources, focusing on credential lifecycle management and usage tracking. Examples include API keys, service account keys, client certificates, and vendor-specific access tokens.","properties":{"last_used_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The timestamp when this programmatic credential was last used for authentication or API access. This helps track credential usage patterns, identify dormant credentials that may pose security risks, and support credential lifecycle management. The timestamp should reflect the most recent successful authentication or API call using this credential."},"last_used_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when this programmatic credential was last used for authentication or API access. This helps track credential usage patterns, identify dormant credentials that may pose security risks, and support credential lifecycle management. The timestamp should reflect the most recent successful authentication or API call using this credential."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type or category of programmatic credential, normalized to the caption of the type_id value. In the case of 'Other', it is defined by the event source. Examples include 'API Key', 'Service Account Key', 'Access Token', 'Client Certificate', 'OAuth Token', 'Personal Access Token', etc."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","description":"The unique identifier of the programmatic credential. This could be an API key ID, service account key ID, access token identifier, certificate serial number, or other unique identifier that distinguishes this credential from others. Examples: AWS Access Key ID, GCP Service Account Key ID, Azure Application ID, or OAuth2 token identifier."}},"required":["uid"]}},"components/schemas/ocsfv1.6.0Remediation":{"id":"components/schemas/ocsfv1.6.0Remediation","kind":"json-schema","title":"ocsfv1.6.0Remediation","data":{"title":"ocsfv1.6.0Remediation","type":"object","description":"The Remediation object describes the recommended remediation steps to address identified issue(s).","properties":{"cis_controls":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0CisControl"},"nullable":true,"description":"An array of Center for Internet Security (CIS) Controls that can be optionally mapped to provide additional remediation details."},"desc":{"type":"string","description":"The description of the remediation strategy."},"kb_article_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0KbArticle"},"nullable":true,"description":"A list of KB articles or patches related to an endpoint. A KB Article contains metadata that describes the patch or an update."},"kb_articles":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The KB article/s related to the entity. A KB Article contains metadata that describes the patch or an update."},"references":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of supporting URL/s, references that help describe the remediation strategy."}},"required":["desc"]}},"components/schemas/ocsfv1.6.0Reputation":{"id":"components/schemas/ocsfv1.6.0Reputation","kind":"json-schema","title":"ocsfv1.6.0Reputation","data":{"title":"ocsfv1.6.0Reputation","type":"object","description":"The Reputation object describes the reputation/risk score of an entity (e.g. device, user, domain).","properties":{"base_score":{"type":"number","format":"double","description":"The reputation score as reported by the event source."},"provider":{"type":"string","nullable":true,"description":"The provider of the reputation information."},"score":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The reputation score, normalized to the caption of the score_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"score_id":{"$ref":"#/components/schemas/ocsfv1.6.0Reputation_ScoreId","description":"The normalized reputation score identifier."}},"required":["base_score","score_id"]}},"components/schemas/ocsfv1.6.0Reputation_ScoreId":{"id":"components/schemas/ocsfv1.6.0Reputation_ScoreId","kind":"json-schema","title":"ocsfv1.6.0Reputation_ScoreId","data":{"title":"ocsfv1.6.0Reputation_ScoreId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ReputationScoreId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The reputation score is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - VerySafe: Long history of good behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Safe: Consistently good behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - ProbablySafe: Reasonable history of good behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - LeansSafe: Starting to establish a history of normal behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - MaynotbeSafe: No established history of normal behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - ExerciseCaution: Starting to establish a history of suspicious or risky behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Risky: A site with a history of suspicious or risky behavior. (spam, scam, potentially unwanted software, potentially malicious)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - PossiblyMalicious: Strong possibility of maliciousness."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - ProbablyMalicious: Indicators of maliciousness."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Malicious: Proven evidence of maliciousness."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The reputation score is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"rep_score"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Request":{"id":"components/schemas/ocsfv1.6.0Request","kind":"json-schema","title":"ocsfv1.6.0Request","data":{"title":"ocsfv1.6.0Request","type":"object","description":"The Request Elements object describes characteristics of an API request.","properties":{"containers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Container"},"nullable":true,"description":"When working with containerized applications, the set of containers which write to the standard the output of a particular logging driver. For example, this may be the set of containers involved in handling api requests and responses for a containerized application."},"data":{"nullable":true,"description":"The additional data that is associated with the api request."},"flags":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The communication flags that are associated with the api request."},"uid":{"type":"string","description":"The unique request identifier."}},"required":["uid"]}},"components/schemas/ocsfv1.6.0Response":{"id":"components/schemas/ocsfv1.6.0Response","kind":"json-schema","title":"ocsfv1.6.0Response","data":{"title":"ocsfv1.6.0Response","type":"object","description":"The Response Elements object describes characteristics of an API response.","properties":{"code":{"type":"integer","nullable":true,"description":"The numeric response sent to a request."},"containers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Container"},"nullable":true,"description":"When working with containerized applications, the set of containers which write to the standard the output of a particular logging driver. For example, this may be the set of containers involved in handling api requests and responses for a containerized application."},"data":{"nullable":true,"description":"The additional data that is associated with the api response."},"error":{"type":"string","nullable":true,"description":"Error Code"},"error_message":{"type":"string","nullable":true,"description":"Error Message"},"flags":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The communication flags that are associated with the api response."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."}}}},"components/schemas/ocsfv1.6.0Rule":{"id":"components/schemas/ocsfv1.6.0Rule","kind":"json-schema","title":"ocsfv1.6.0Rule","data":{"title":"ocsfv1.6.0Rule","type":"object","description":"The Rule object describes characteristics of a rule associated with a policy or an event.","properties":{"category":{"type":"string","nullable":true,"description":"The rule category."},"desc":{"type":"string","nullable":true,"description":"The description of the rule that generated the event."},"name":{"type":"string","nullable":true,"description":"The name of the rule that generated the event."},"type":{"type":"string","nullable":true,"description":"The rule type."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the rule that generated the event."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The rule version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.6.0San":{"id":"components/schemas/ocsfv1.6.0San","kind":"json-schema","title":"ocsfv1.6.0San","data":{"title":"ocsfv1.6.0San","type":"object","description":"The Subject Alternative name (SAN) object describes a SAN secured by a digital certificate","properties":{"name":{"type":"string","description":"Name of SAN (e.g. The actual IP Address or domain.)"},"type":{"type":"string","description":"Type descriptor of SAN (e.g. IP Address/domain/etc.)"}},"required":["name","type"]}},"components/schemas/ocsfv1.6.0Scim":{"id":"components/schemas/ocsfv1.6.0Scim","kind":"json-schema","title":"ocsfv1.6.0Scim","data":{"title":"ocsfv1.6.0Scim","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The System for Cross-domain Identity Management (SCIM) Configuration object provides a structured set of attributes related to SCIM protocols used for identity provisioning and management across cloud-based platforms. It standardizes user and group provisioning details, enabling identity synchronization and lifecycle management with compatible Identity Providers (IdPs) and applications. SCIM is defined in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc7643"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-7634"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"auth_protocol":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The authorization protocol as defined by the caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"auth_protocol_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"auth_protocol_id":{"$ref":"#/components/schemas/ocsfv1.6.0Scim_AuthProtocolId","nullable":true,"description":"The normalized identifier of the authorization protocol used by the SCIM resource."},"created_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"When the SCIM resource was added to the service provider."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"When the SCIM resource was added to the service provider."},"error_message":{"type":"string","nullable":true,"description":"Message or code associated with the last encountered error."},"is_group_provisioning_enabled":{"type":"boolean","nullable":true,"description":"Indicates whether the SCIM resource is configured to provision groups, automatically or otherwise."},"is_user_provisioning_enabled":{"type":"boolean","nullable":true,"description":"Indicates whether the SCIM resource is configured to provision users, automatically or otherwise."},"last_run_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"Timestamp of the most recent successful synchronization."},"last_run_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the most recent successful synchronization."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The most recent time when the SCIM resource was updated at the service provider."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent time when the SCIM resource was updated at the service provider."},"name":{"type":"string","nullable":true,"description":"The name of the SCIM resource."},"protocol_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The supported protocol for the SCIM resource. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SAML"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OIDC"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OAuth2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"rate_limit":{"type":"integer","nullable":true,"description":"Maximum number of requests allowed by the SCIM resource within a specified time frame to avoid throttling."},"scim_group_schema":{"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SCIM provides a schema for representing groups, identified using the following schema URI: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"urn:ietf:params:scim:schemas:core:2.0:Group"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" as defined in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc7643"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-7634"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". This attribute will capture key-value pairs for the scheme implemented in a SCIM resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"scim_user_schema":{"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SCIM provides a resource type for user resources. The core schema for user is identified using the following schema URI: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"urn:ietf:params:scim:schemas:core:2.0:User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" as defined in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc7643"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-7634"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". his attribute will capture key-value pairs for the scheme implemented in a SCIM resource. This object is inclusive of both the basic and Enterprise User Schema Extension."},"children":[],"type":"text"}],"type":"paragraph"}]},"state":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The provisioning state of the SCIM resource, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"state_id":{"$ref":"#/components/schemas/ocsfv1.6.0Scim_StateId","nullable":true,"description":"The normalized state ID of the SCIM resource to reflect its activation status."},"uid":{"type":"string","nullable":true,"description":"A unique identifier for a SCIM resource as defined by the service provider."},"uid_alt":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A String that is an identifier for the resource as defined by the provisioning client. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"externalId"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" may simplify identification of a resource between the provisioning client and the service provider by allowing the client to use a filter to locate the resource with an identifier from the provisioning domain, obviating the need to store a local mapping between the provisioning domain's identifier of the resource and the identifier used by the service provider."},"children":[],"type":"text"}],"type":"paragraph"}]},"url_string":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":"The primary URL for SCIM API requests."},"vendor_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Name of the vendor or service provider implementing SCIM. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Okta"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Auth0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Microsoft"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SCIM protocol version supported e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SCIM 2.0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.6.0Scim_AuthProtocolId":{"id":"components/schemas/ocsfv1.6.0Scim_AuthProtocolId","kind":"json-schema","title":"ocsfv1.6.0Scim_AuthProtocolId","data":{"title":"ocsfv1.6.0Scim_AuthProtocolId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ScimAuthProtocolId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The authentication protocol is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - NTLM"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Kerberos"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Digest"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - OpenID"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - SAML"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - 0"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - PAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - CHAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - EAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - RADIUS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - BasicAuthentication"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - LDAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The authentication protocol is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"auth_protocol"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Scim_StateId":{"id":"components/schemas/ocsfv1.6.0Scim_StateId","kind":"json-schema","title":"ocsfv1.6.0Scim_StateId","data":{"title":"ocsfv1.6.0Scim_StateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ScimStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The provisioning state of the SCIM resource is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Pending: The SCIM resource is Pending activation or creation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Active: The SCIM resource is in an Active state, or otherwise enabled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Failed: The SCIM resource is in a Failed state."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Deleted: The SCIM resource is in a Deleted state, or otherwise disabled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The provisioning state of the SCIM resource is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Script":{"id":"components/schemas/ocsfv1.6.0Script","kind":"json-schema","title":"ocsfv1.6.0Script","data":{"title":"ocsfv1.6.0Script","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Script object describes a script or command that can be executed by a shell, script engine, or interpreter. Examples include Bash, JavsScript, PowerShell, Python, VBScript, etc. Note that the term "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"em","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"script"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" here denotes not only a script contained within a file but also a script or command typed interactively by a user, supplied on the command line, or provided by some other file-less mechanism."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"file":{"$ref":"#/components/schemas/ocsfv1.6.0File","nullable":true,"description":"Present if this script is associated with a file. Not present in the case of a file-less script."},"hashes":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Fingerprint"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of the script's cryptographic hashes. Note that these hashes are calculated on the script in its original encoding, and not on the normalized UTF-8 encoding found in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"script_content"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","nullable":true,"description":"Unique identifier for the script or macro, independent of the containing file, used for tracking, auditing, and security analysis."},"parent_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This attribute relates a sub-script to a parent script having the matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute. In the case of PowerShell, sub-script execution can be identified by matching the activity correlation ID of the raw ETW events provided by the OS."},"children":[],"type":"text"}],"type":"paragraph"}]},"script_content":{"$ref":"#/components/schemas/ocsfv1.6.0LongString","description":"The script content, normalized to UTF-8 encoding irrespective of its original encoding. When emitting this attribute, it may be appropriate to truncate large scripts. When consuming this attribute, large scripts should be anticipated."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The script type, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0Script_TypeId","description":"The normalized script type ID."},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Some script engines assign a unique ID to each individual execution of a given script. This attribute captures that unique ID. In the case of PowerShell, the unique ID corresponds to the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ScriptBlockId"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in the raw ETW events provided by the OS."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["script_content","type_id"]}},"components/schemas/ocsfv1.6.0Script_TypeId":{"id":"components/schemas/ocsfv1.6.0Script_TypeId","kind":"json-schema","title":"ocsfv1.6.0Script_TypeId","data":{"title":"ocsfv1.6.0Script_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ScriptTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The script type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - WindowsCommandPrompt"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - PowerShell"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Python"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - JavaScript"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - VBScript"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - UnixShell"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - VBA"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The script type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute which contains an event source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Service":{"id":"components/schemas/ocsfv1.6.0Service","kind":"json-schema","title":"ocsfv1.6.0Service","data":{"title":"ocsfv1.6.0Service","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Service object describes characteristics of a service, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. AWS EC2. "},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels associated with the service."},"name":{"type":"string","nullable":true,"description":"The name of the service."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the service."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the service."},"version":{"type":"string","nullable":true,"description":"The version of the service."}}}},"components/schemas/ocsfv1.6.0Session":{"id":"components/schemas/ocsfv1.6.0Session","kind":"json-schema","title":"ocsfv1.6.0Session","data":{"title":"ocsfv1.6.0Session","type":"object","description":"The Session object describes details about an authenticated session. e.g. Session Creation Time, Session Issuer.","properties":{"count":{"type":"integer","nullable":true,"description":"The number of identical sessions spawned from the same source IP, destination IP, application, and content/threat type seen over a period of time."},"created_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the session was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the session was created."},"credential_uid":{"type":"string","nullable":true,"description":"The unique identifier of the user's credential. For example, AWS Access Key ID."},"expiration_reason":{"type":"string","nullable":true,"description":"The reason which triggered the session expiration."},"expiration_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The session expiration time."},"expiration_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The session expiration time."},"is_mfa":{"type":"boolean","nullable":true,"description":"Indicates whether Multi Factor Authentication was used during authentication."},"is_remote":{"type":"boolean","nullable":true,"description":"The indication of whether the session is remote."},"is_vpn":{"type":"boolean","nullable":true,"description":"The indication of whether the session is a VPN session."},"issuer":{"type":"string","nullable":true,"description":"The identifier of the session issuer."},"terminal":{"type":"string","nullable":true,"description":"The Pseudo Terminal associated with the session. Ex: the tty or pts value."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the session."},"uid_alt":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The alternate unique identifier of the session. e.g. AWS ARN - "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"arn:aws:sts::123344444444:assumed-role/Admin/example-session"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uuid":{"type":"string","nullable":true,"description":"The universally unique identifier of the session."}}}},"components/schemas/ocsfv1.6.0Sharing":{"id":"components/schemas/ocsfv1.6.0Sharing","kind":"json-schema","title":"ocsfv1.6.0Sharing","data":{"title":"ocsfv1.6.0Sharing","type":"object","description":"The Sharing object encompasses information about how and with whom a resource was shared.","properties":{"actors":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Actor"},"nullable":true,"description":"The actor(s) with whom the resource has been shared. Note that with the addition of groups to the Actor object, sharing with a group can be represented by an Actor object with an empty user field and a populated groups field."},"anonymous":{"type":"boolean","nullable":true,"description":"True if anonymous access is enabled for sharing."},"can_reshare":{"type":"boolean","nullable":true,"description":"True if the recipients have permission to re-share the resource."},"link_id":{"type":"string","nullable":true,"description":"Unique ID of a sharing link."},"permissions":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0SharingPermission"},"nullable":true,"description":"List of permissions granted."},"scope":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The scope, normalized to the caption of the scope_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"scope_id":{"$ref":"#/components/schemas/ocsfv1.6.0Sharing_ScopeId","nullable":true,"description":"The normalized identifier of the sharing scope."},"sharing_action":{"type":"string","nullable":true,"description":"Describes the nature of a sharing action, such as creating a link for others to access a resource."}}}},"components/schemas/ocsfv1.6.0Sharing_ScopeId":{"id":"components/schemas/ocsfv1.6.0Sharing_ScopeId","kind":"json-schema","title":"ocsfv1.6.0Sharing_ScopeId","data":{"title":"ocsfv1.6.0Sharing_ScopeId","type":"integer","description":"SharingScopeId is an enum, and the following values are allowed.\n0 - Unknown: The scope is unknown.\n1 - User: User scope.\n2 - Group: Group scope.\n3 - Tenant: Tenant scope.\n4 - Organization: Organization scope.\n5 - World: World scope.\n99 - Other: The scope is not mapped."}},"components/schemas/ocsfv1.6.0SharingPermission":{"id":"components/schemas/ocsfv1.6.0SharingPermission","kind":"json-schema","title":"ocsfv1.6.0SharingPermission","data":{"title":"ocsfv1.6.0SharingPermission","type":"object","description":"The Sharing Permission type represents the permissions granted to recipients via a Sharing object.","properties":{"sharing_permission_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The sharing permission type, normalized to the caption of the sharing_permission_type_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"sharing_permission_type_id":{"$ref":"#/components/schemas/ocsfv1.6.0SharingPermission_SharingPermissionTypeId","description":"The normalized identifier of the sharing permission type."}},"required":["sharing_permission_type_id"]}},"components/schemas/ocsfv1.6.0SharingPermission_SharingPermissionTypeId":{"id":"components/schemas/ocsfv1.6.0SharingPermission_SharingPermissionTypeId","kind":"json-schema","title":"ocsfv1.6.0SharingPermission_SharingPermissionTypeId","data":{"title":"ocsfv1.6.0SharingPermission_SharingPermissionTypeId","type":"integer","description":"SharingPermissionSharingPermissionTypeId is an enum, and the following values are allowed.\n0 - Unknown: The sharing permission type is unknown.\n1 - View: View permission.\n2 - Modify: Modify permission.\n99 - Other: The sharing permission type is not mapped."}},"components/schemas/ocsfv1.6.0Sso":{"id":"components/schemas/ocsfv1.6.0Sso","kind":"json-schema","title":"ocsfv1.6.0Sso","data":{"title":"ocsfv1.6.0Sso","type":"object","description":"The Single Sign-On (SSO) object provides a structure for normalizing SSO attributes, configuration, and/or settings from Identity Providers.","properties":{"auth_protocol":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The authorization protocol as defined by the caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"auth_protocol_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"auth_protocol_id":{"$ref":"#/components/schemas/ocsfv1.6.0Sso_AuthProtocolId","nullable":true,"description":"The normalized identifier of the authentication protocol used by the SSO resource."},"certificate":{"$ref":"#/components/schemas/ocsfv1.6.0Certificate","nullable":true,"description":"Digital Signature associated with the SSO resource, e.g., SAML X.509 certificate details."},"created_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"When the SSO resource was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"When the SSO resource was created."},"duration_mins":{"type":"integer","nullable":true,"description":"The duration (in minutes) for an SSO session, after which re-authentication is required."},"idle_timeout":{"type":"integer","nullable":true,"description":"Duration (in minutes) of allowed inactivity before Single Sign-On (SSO) session expiration."},"login_endpoint":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":"URL for initiating an SSO login request."},"logout_endpoint":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":"URL for initiating an SSO logout request, allowing sessions to be terminated across applications."},"metadata_endpoint":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":"URL where metadata about the SSO configuration is available (e.g., for SAML configurations)."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The most recent time when the SSO resource was updated."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent time when the SSO resource was updated."},"name":{"type":"string","nullable":true,"description":"The name of the SSO resource."},"protocol_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The supported protocol for the SSO resource. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SAML"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OIDC"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"scopes":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Scopes define the specific permissions or actions that the client is allowed to perform on behalf of the user. Each scope represents a different set of permissions, and the user can selectively grant or deny access to specific scopes during the authorization process."},"uid":{"type":"string","nullable":true,"description":"A unique identifier for a SSO resource."},"vendor_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Name of the vendor or service provider implementing SSO. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Okta"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Auth0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Microsoft"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.6.0Sso_AuthProtocolId":{"id":"components/schemas/ocsfv1.6.0Sso_AuthProtocolId","kind":"json-schema","title":"ocsfv1.6.0Sso_AuthProtocolId","data":{"title":"ocsfv1.6.0Sso_AuthProtocolId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SsoAuthProtocolId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The authentication protocol is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - NTLM"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Kerberos"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Digest"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - OpenID"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - SAML"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - 0"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - PAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - CHAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - EAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - RADIUS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - BasicAuthentication"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - LDAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The authentication protocol is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"auth_protocol"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0SubTechnique":{"id":"components/schemas/ocsfv1.6.0SubTechnique","kind":"json-schema","title":"ocsfv1.6.0SubTechnique","data":{"title":"ocsfv1.6.0SubTechnique","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE Sub-technique object describes the ATT&CK® or ATLAS™ Sub-technique ID and/or name associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the attack sub-technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Scanning IP Blocks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User Execution: Unsafe ML Artifacts"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The versioned permalink of the attack sub-technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://attack.mitre.org/versions/v14/techniques/T1595/001/"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the attack sub-technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"T1595.001"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AML.T0011.000"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.6.0Tactic":{"id":"components/schemas/ocsfv1.6.0Tactic","kind":"json-schema","title":"ocsfv1.6.0Tactic","data":{"title":"ocsfv1.6.0Tactic","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE Tactic object describes the ATT&CK® or ATLAS™ Tactic ID and/or name that is associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Tactic name that is associated with the attack technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Reconnaissance"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ML Model Access"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The versioned permalink of the Tactic. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://attack.mitre.org/versions/v14/tactics/TA0043/"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Tactic ID that is associated with the attack technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TA0043"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AML.TA0000"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.6.0Technique":{"id":"components/schemas/ocsfv1.6.0Technique","kind":"json-schema","title":"ocsfv1.6.0Technique","data":{"title":"ocsfv1.6.0Technique","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE Technique object describes the ATT&CK® or ATLAS™ Technique ID and/or name associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the attack technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Active Scanning"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AI Model Inference API Access"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The versioned permalink of the attack technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://attack.mitre.org/versions/v14/techniques/T1595/"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the attack technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"T1595"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AML.T0040"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.6.0ThreatActor":{"id":"components/schemas/ocsfv1.6.0ThreatActor","kind":"json-schema","title":"ocsfv1.6.0ThreatActor","data":{"title":"ocsfv1.6.0ThreatActor","type":"object","description":"Threat actor is responsible for the observed malicious activity.","properties":{"name":{"type":"string","description":"The name of the threat actor."},"type":{"type":"string","nullable":true,"description":"The classification of the threat actor based on their motivations, capabilities, or affiliations. Common types include nation-state actors, cybercriminal groups, hacktivists, or insider threats."},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0ThreatActor_TypeId","nullable":true,"description":"The normalized datastore resource type identifier."}},"required":["name"]}},"components/schemas/ocsfv1.6.0ThreatActor_TypeId":{"id":"components/schemas/ocsfv1.6.0ThreatActor_TypeId","kind":"json-schema","title":"ocsfv1.6.0ThreatActor_TypeId","data":{"title":"ocsfv1.6.0ThreatActor_TypeId","type":"integer","description":"ThreatActorTypeId is an enum, and the following values are allowed.\n0 - Unknown: The threat actor type is unknown.\n1 - state\n2 - Cybercriminal\n3 - Hacktivists\n4 - Insider\n99 - Other: The threat actor type is not mapped."}},"components/schemas/ocsfv1.6.0Timespan":{"id":"components/schemas/ocsfv1.6.0Timespan","kind":"json-schema","title":"ocsfv1.6.0Timespan","data":{"title":"ocsfv1.6.0Timespan","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Time Span object represents different time period durations. If a timespan is fractional, i.e. crosses one period, e.g. a week and 3 days, more than one may be populated since each member is of integral type. In that case "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A timespan may also be defined by its time interval boundaries, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"duration":{"type":"integer","nullable":true,"description":"The duration of the time span in milliseconds."},"duration_days":{"type":"integer","nullable":true,"description":"The duration of the time span in days."},"duration_hours":{"type":"integer","nullable":true,"description":"The duration of the time span in hours."},"duration_mins":{"type":"integer","nullable":true,"description":"The duration of the time span in minutes."},"duration_months":{"type":"integer","nullable":true,"description":"The duration of the time span in months."},"duration_secs":{"type":"integer","nullable":true,"description":"The duration of the time span in seconds."},"duration_weeks":{"type":"integer","nullable":true,"description":"The duration of the time span in weeks."},"duration_years":{"type":"integer","nullable":true,"description":"The duration of the time span in years."},"end_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The end time or conclusion of the timespan's interval."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time or conclusion of the timespan's interval."},"start_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The start time or beginning of the timespan's interval."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time or beginning of the timespan's interval."},"type":{"type":"string","nullable":true,"description":"The type of time span duration the object represents."},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0Timespan_TypeId","nullable":true,"description":"The normalized identifier for the time span duration type."}}}},"components/schemas/ocsfv1.6.0Timespan_TypeId":{"id":"components/schemas/ocsfv1.6.0Timespan_TypeId","kind":"json-schema","title":"ocsfv1.6.0Timespan_TypeId","data":{"title":"ocsfv1.6.0Timespan_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TimespanTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Milliseconds"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Seconds"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Minutes"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Hours"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Days"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Weeks"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Months"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Years"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - TimeInterval: The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" should be set."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Tls":{"id":"components/schemas/ocsfv1.6.0Tls","kind":"json-schema","title":"ocsfv1.6.0Tls","data":{"title":"ocsfv1.6.0Tls","type":"object","description":"The Transport Layer Security (TLS) object describes the negotiated TLS protocol used for secure communications over an establish network connection.","properties":{"alert":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The integer value of TLS alert if present. The alerts are defined in the TLS specification in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc2246"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-2246"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"certificate":{"$ref":"#/components/schemas/ocsfv1.6.0Certificate","nullable":true,"description":"The certificate object containing information about the digital certificate."},"certificate_chain":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The Chain of Certificate Serial Numbers field provides a chain of Certificate Issuer Serial Numbers leading to the Root Certificate Issuer."},"cipher":{"type":"string","nullable":true,"description":"The negotiated cipher suite."},"client_ciphers":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The client cipher suites that were exchanged during the TLS handshake negotiation."},"extension_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0TlsExtension"},"nullable":true,"description":"The list of TLS extensions."},"handshake_dur":{"type":"integer","nullable":true,"description":"The amount of total time for the TLS handshake to complete after the TCP connection is established, including client-side delays, in milliseconds."},"ja3_hash":{"$ref":"#/components/schemas/ocsfv1.6.0Fingerprint","nullable":true,"description":"The MD5 hash of a JA3 string."},"ja3s_hash":{"$ref":"#/components/schemas/ocsfv1.6.0Fingerprint","nullable":true,"description":"The MD5 hash of a JA3S string."},"key_length":{"type":"integer","nullable":true,"description":"The length of the encryption key."},"sans":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0San"},"nullable":true,"description":"The list of subject alternative names that are secured by a specific certificate."},"server_ciphers":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The server cipher suites that were exchanged during the TLS handshake negotiation."},"sni":{"type":"string","nullable":true,"description":" The Server Name Indication (SNI) extension sent by the client."},"tls_extension_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0TlsExtension"},"nullable":true,"description":"The list of TLS extensions."},"version":{"type":"string","description":"The TLS protocol version."}},"required":["version"]}},"components/schemas/ocsfv1.6.0TlsExtension":{"id":"components/schemas/ocsfv1.6.0TlsExtension","kind":"json-schema","title":"ocsfv1.6.0TlsExtension","data":{"title":"ocsfv1.6.0TlsExtension","type":"object","description":"The TLS Extension object describes additional attributes that extend the base Transport Layer Security (TLS) object.","properties":{"data":{"nullable":true,"description":"The data contains information specific to the particular extension type."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The TLS extension type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Server Name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0TlsExtension_TypeId","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The TLS extension type identifier. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc8446#page-35"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Transport Layer Security (TLS) extension page"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["type_id"]}},"components/schemas/ocsfv1.6.0TlsExtension_TypeId":{"id":"components/schemas/ocsfv1.6.0TlsExtension_TypeId","kind":"json-schema","title":"ocsfv1.6.0TlsExtension_TypeId","data":{"title":"ocsfv1.6.0TlsExtension_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TlsExtensionTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - name: The Server Name Indication extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - fragment_length: The Maximum Fragment Length Negotiation extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - request: The Certificate Status Request extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - groups: The Supported Groups extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - algorithms: The Signature Algorithms extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - srtp: The Use SRTP data protection extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - heartbeat: The Heartbeat extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - layer_protocol_negotiation: The Application-Layer Protocol Negotiation extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - certificate_timestamp: The Signed Certificate Timestamp extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - certificate_type: The Client Certificate Type extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - certificate_type: The Server Certificate Type extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - padding: The Padding extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"41 - shared_key: The Pre Shared Key extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"42 - data: The Early Data extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"43 - versions: The Supported Versions extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"44 - cookie: The Cookie extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"45 - key_exchange_modes: The Pre-Shared Key Exchange Modes extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"47 - authorities: The Certificate Authorities extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"48 - filters: The OID Filters extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"49 - handshake_auth: The Post-Handshake Client Authentication extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"50 - algorithms_cert: The Signature Algorithms extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"51 - share: The Key Share extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0TransformationInfo":{"id":"components/schemas/ocsfv1.6.0TransformationInfo","kind":"json-schema","title":"ocsfv1.6.0TransformationInfo","data":{"title":"ocsfv1.6.0TransformationInfo","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The transformation_info object represents the mapping or transformation used."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"lang":{"type":"string","nullable":true,"description":"The transformation language used to transform the data."},"name":{"type":"string","nullable":true,"description":"The name of the transformation or mapping."},"product":{"$ref":"#/components/schemas/ocsfv1.6.0Product","nullable":true,"description":"The product or instance used to make the transformation"},"time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"Time of the transformation."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"Time of the transformation."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the mapping or transformation."},"url_string":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":"The Uniform Resource Locator String where the mapping or transformation exists."}}}},"components/schemas/ocsfv1.6.0Url":{"id":"components/schemas/ocsfv1.6.0Url","kind":"json-schema","title":"ocsfv1.6.0Url","data":{"title":"ocsfv1.6.0Url","type":"object","description":"The Uniform Resource Locator (URL) object describes the characteristics of a URL.","properties":{"categories":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Website categorization names, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"category_ids"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" enum values."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_ids":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Url_CategoryIds"},"nullable":true,"description":"The Website categorization identifiers."},"domain":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The domain portion of the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://sub.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"hostname":{"$ref":"#/components/schemas/ocsfv1.6.0Hostname","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL host as extracted from the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"www.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"www.example.com/download/trouble"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"path":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL path as extracted from the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"/download/trouble"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"www.example.com/download/trouble"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"port":{"$ref":"#/components/schemas/ocsfv1.6.0Port","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL port. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"80"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"query_string":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The query portion of the URL. For example: the query portion of the URL "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http://www.example.com/search?q=bad&sort=date"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"q=bad&sort=date"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"resource_type":{"type":"string","nullable":true,"description":"The context in which a resource was retrieved in a web request."},"scheme":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The scheme portion of the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ftp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"sftp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"subdomain":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The subdomain portion of the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"sub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://sub.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"sub2.sub1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://sub2.sub1.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"url_string":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL string. See RFC 1738. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http://www.example.com/download/trouble.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Note: The URL path should not populate the URL string."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.6.0Url_CategoryIds":{"id":"components/schemas/ocsfv1.6.0Url_CategoryIds","kind":"json-schema","title":"ocsfv1.6.0Url_CategoryIds","data":{"title":"ocsfv1.6.0Url_CategoryIds","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UrlCategoryIds is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The Domain/URL category is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - MatureContent"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Pornography"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - SexEducation"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Swimsuit"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Nudity"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Extreme"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Questionable_Illegal"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Gambling"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Hate_Racism"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Weapons"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - Abortion"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Hacking"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Phishing"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Entertainment"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Economy"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Belief"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Alcohol"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - Tobacco"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - ControlledSubstances"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - ChildPornography"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Education"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"29 - CharitableOrganizations"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"30 - Culture"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"31 - FinancialServices"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"32 - Trading"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"33 - Games"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"34 - Legal"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"35 - Military"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"36 - SocialAdvocacy"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"37 - Health"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"38 - Internet"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"40 - Portals"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"43 - Malnets"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"44 - Botnets"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"45 - Careers"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"46 - Media"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"47 - Dating"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"49 - Reference"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"50 - PotentiallyAdult"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"51 - IM_SMS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"52 - Email"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"53 - Forums"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"54 - Religion"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"55 - SocialNetworking"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"56 - Sharing"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"57 - RemoteAccessTools"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"58 - Shopping"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"59 - Auctions"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"60 - RealEstate"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"61 - DailyLiving"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"63 - PersonalSites"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"64 - Dining_Food"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"65 - Recreation"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"66 - Travel"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"67 - Vehicles"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"68 - Jokes"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"71 - SoftwareDownloads"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"83 - to_Peer_P2P_"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"84 - VideoClips"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"85 - BusinessApplications"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"86 - ProxyAvoidance"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"87 - ForKids"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"88 - Analytics"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"89 - WebHosting"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"90 - Uncategorized"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"92 - Suspicious"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"93 - SexualExpression"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"95 - Translation"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"96 - Viewable_Infrastructure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"97 - ContentServers"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"98 - Placeholders"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The Domain/URL category is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"categories"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"101 - Spam"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"102 - PotentiallyUnwantedSoftware"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"103 - DynamicDNSHost"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"106 - Card_Invitations"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"107 - Informational"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"108 - InformationSecurity"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"109 - InternetConnectedDevices"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"110 - InternetTelephony"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"111 - OnlineMeetings"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"112 - MediaSharing"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"113 - AudioStreams"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"114 - VideoStreams"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"118 - CopyrightConcerns"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"121 - Marijuana"},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0User":{"id":"components/schemas/ocsfv1.6.0User","kind":"json-schema","title":"ocsfv1.6.0User","data":{"title":"ocsfv1.6.0User","type":"object","description":"The User object describes the characteristics of a user/person or a security principal.","properties":{"account":{"$ref":"#/components/schemas/ocsfv1.6.0Account","nullable":true,"description":"The user's account or the account associated with the user."},"credential_uid":{"type":"string","nullable":true,"description":"The unique identifier of the user's credential. For example, AWS Access Key ID."},"display_name":{"type":"string","nullable":true,"description":"The display name of the user, as reported by the product."},"domain":{"type":"string","nullable":true,"description":"The domain where the user is defined. For example: the LDAP or Active Directory domain."},"email_addr":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress","nullable":true,"description":"The user's primary email address."},"forward_addr":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress","nullable":true,"description":"The user's forwarding email address."},"full_name":{"type":"string","nullable":true,"description":"The full name of the user, as reported by the product."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Group"},"nullable":true,"description":"The administrative groups to which the user belongs."},"has_mfa":{"type":"boolean","nullable":true,"description":"The user has a multi-factor or secondary-factor device assigned."},"ldap_person":{"$ref":"#/components/schemas/ocsfv1.6.0LdapPerson","nullable":true,"description":"The additional LDAP attributes that describe a person."},"leave_events":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0LeaveEvent"},"nullable":true,"description":"Leave of absence events associated with the person. May include current, past, and future leaves."},"mfa_status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The multi-factor authentication status, normalized to the caption of the mfa_status_id value. In the case of 'Other', it is defined by the data source."},"children":[],"type":"text"}],"type":"paragraph"}]},"mfa_status_id":{"$ref":"#/components/schemas/ocsfv1.6.0User_MfaStatusId","nullable":true,"description":"The normalized identifier of the user's multi-factor authentication status."},"name":{"$ref":"#/components/schemas/ocsfv1.6.0UserName","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The username. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"janedoe1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"on_leave":{"type":"boolean","nullable":true,"description":"True if the person is currently on a leave of absence."},"org":{"$ref":"#/components/schemas/ocsfv1.6.0Organization","nullable":true,"description":"Organization and org unit related to the user."},"phone_number":{"type":"string","nullable":true,"description":"The telephone number of the user."},"privileges":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The user's privileges."},"programmatic_credentials":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0ProgrammaticCredential"},"nullable":true,"description":"Details about the programmatic credential (API keys, access tokens, certificates, etc) associated to the user."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.6.0User_RiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"type":{"type":"string","nullable":true,"description":"The type of the user. For example, System, AWS IAM User, etc."},"type_id":{"$ref":"#/components/schemas/ocsfv1.6.0User_TypeId","nullable":true,"description":"The account type identifier."},"uid":{"type":"string","nullable":true,"description":"The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN."},"uid_alt":{"type":"string","nullable":true,"description":"The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID."},"user_status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The user status, normalized to the caption of the user_status_id value. In the case of 'Other', it is defined by the data source."},"children":[],"type":"text"}],"type":"paragraph"}]},"user_status_id":{"$ref":"#/components/schemas/ocsfv1.6.0User_UserStatusId","nullable":true,"description":"The normalized identifier of the user's status."}}}},"components/schemas/ocsfv1.6.0User_MfaStatusId":{"id":"components/schemas/ocsfv1.6.0User_MfaStatusId","kind":"json-schema","title":"ocsfv1.6.0User_MfaStatusId","data":{"title":"ocsfv1.6.0User_MfaStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UserMfaStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Enabled: Multi-factor authentication is enabled for this user."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - NotEnabled: TMulti-factor authentication is off for this user."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Enforced: Multi-factor authentication is enabled and there is a policy that requires it for this user."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"user_status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0User_RiskLevelId":{"id":"components/schemas/ocsfv1.6.0User_RiskLevelId","kind":"json-schema","title":"ocsfv1.6.0User_RiskLevelId","data":{"title":"ocsfv1.6.0User_RiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UserRiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0User_TypeId":{"id":"components/schemas/ocsfv1.6.0User_TypeId","kind":"json-schema","title":"ocsfv1.6.0User_TypeId","data":{"title":"ocsfv1.6.0User_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UserTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - User: Regular user account."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Admin: Admin/root user account."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - System: System account. For example, Windows computer accounts with a trailing dollar sign ($)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Service: Service account. For example, Windows service account."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0User_UserStatusId":{"id":"components/schemas/ocsfv1.6.0User_UserStatusId","kind":"json-schema","title":"ocsfv1.6.0User_UserStatusId","data":{"title":"ocsfv1.6.0User_UserStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UserUserStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Active: The user is active."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Pending: The user is not active, pending either user or admin action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Locked: The user account is locked requiring either time or intervention to unlock."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Suspended: The user account is suspended."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deprovisioned: The user account has been deprovisioned and is pending removal."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"user_status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Vulnerability":{"id":"components/schemas/ocsfv1.6.0Vulnerability","kind":"json-schema","title":"ocsfv1.6.0Vulnerability","data":{"title":"ocsfv1.6.0Vulnerability","type":"object","description":"The vulnerability is an unintended characteristic of a computing component or system configuration that multiplies the risk of an adverse event or a loss occurring either due to accidental exposure, deliberate attack, or conflict with new system components.","properties":{"advisory":{"$ref":"#/components/schemas/ocsfv1.6.0Advisory","nullable":true,"description":"Detail about the security advisory, that is used to publicly disclose cybersecurity vulnerabilities by a vendor."},"affected_code":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0AffectedCode"},"nullable":true,"description":"List of Affected Code objects that describe details about code blocks identified as vulnerable."},"affected_packages":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0AffectedPackage"},"nullable":true,"description":"List of software packages identified as affected by a vulnerability/vulnerabilities."},"category":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The category of a vulnerability or weakness, as reported by the source tool, such as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Container Security"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Open Source Security"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cve":{"$ref":"#/components/schemas/ocsfv1.6.0Cve","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the Common Vulnerabilities and Exposures "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cve.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"(CVE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" details related to the vulnerability."},"children":[],"type":"text"}],"type":"paragraph"}]},"cwe":{"$ref":"#/components/schemas/ocsfv1.6.0Cwe","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the Common Weakness Enumeration "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"(CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" details related to the vulnerability."},"children":[],"type":"text"}],"type":"paragraph"}]},"dependency_chain":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Information about the chain of dependencies related to the issue as reported by an Application Security or Vulnerability Management tool. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"serverless-offline -> @serverless/utils -> memoizee -> es5-ext"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"desc":{"type":"string","nullable":true,"description":"The description of the vulnerability."},"exploit_last_seen_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the exploit was most recently observed."},"exploit_last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the exploit was most recently observed."},"exploit_ref_url":{"$ref":"#/components/schemas/ocsfv1.6.0URLString","nullable":true,"description":"The URL of the exploit code or Proof-of-Concept (PoC)."},"exploit_requirement":{"type":"string","nullable":true,"description":"The requirement description related to any constraints around exploit execution."},"exploit_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The categorization or type of Exploit. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Network"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Physical"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"first_seen_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the vulnerability was first observed."},"first_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the vulnerability was first observed."},"fix_available":{"type":"boolean","nullable":true,"description":"Indicates if a fix is available for the reported vulnerability."},"fix_coverage":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The fix coverage, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"fix_coverage_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value."},"children":[],"type":"text"}],"type":"paragraph"}]},"fix_coverage_id":{"$ref":"#/components/schemas/ocsfv1.6.0Vulnerability_FixCoverageId","nullable":true,"description":"The normalized identifier for fix coverage, applicable to this vulnerability. Typically useful, when there are multiple affected packages but only a subset have available fixes."},"is_exploit_available":{"type":"boolean","nullable":true,"description":"Indicates if an exploit or a PoC (proof-of-concept) is available for the reported vulnerability."},"is_fix_available":{"type":"boolean","nullable":true,"description":"Indicates if a fix is available for the reported vulnerability."},"kb_article_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0KbArticle"},"nullable":true,"description":"A list of KB articles or patches related to an endpoint. A KB Article contains metadata that describes the patch or an update."},"kb_articles":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The KB article/s related to the entity. A KB Article contains metadata that describes the patch or an update."},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"The time when the vulnerability was most recently observed."},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the vulnerability was most recently observed."},"packages":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0Package"},"nullable":true,"description":"List of vulnerable packages as identified by the security product"},"references":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of reference URLs with additional information about the vulnerability."},"related_vulnerabilities":{"type":"array","items":{"type":"string"},"nullable":true,"description":"List of vulnerability IDs (e.g. CVE ID) that are related to this vulnerability."},"remediation":{"$ref":"#/components/schemas/ocsfv1.6.0Remediation","nullable":true,"description":"The remediation recommendations on how to mitigate the identified vulnerability."},"severity":{"type":"string","nullable":true,"description":"The vendor assigned severity of the vulnerability."},"title":{"type":"string","nullable":true,"description":"A title or a brief phrase summarizing the discovered vulnerability."},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor that identified the vulnerability."},"xattributes":{"$ref":"#/components/schemas/ocsfv1.6.0Object","nullable":true,"description":"An unordered collection of zero or more name/value pairs that represent a vulnerability's extended attributes and are specific to the event source."}}}},"components/schemas/ocsfv1.6.0Vulnerability_FixCoverageId":{"id":"components/schemas/ocsfv1.6.0Vulnerability_FixCoverageId","kind":"json-schema","title":"ocsfv1.6.0Vulnerability_FixCoverageId","data":{"title":"ocsfv1.6.0Vulnerability_FixCoverageId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"VulnerabilityFixCoverageId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The fix coverage is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Complete: All affected packages and components have available fixes or patches to remediate the vulnerability."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Partial: Only some of the affected packages and components have available fixes or patches, while others remain vulnerable."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - None: No fixes or patches are currently available for any of the affected packages and components."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The fix coverage is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"fix_coverage"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.6.0Whois":{"id":"components/schemas/ocsfv1.6.0Whois","kind":"json-schema","title":"ocsfv1.6.0Whois","data":{"title":"ocsfv1.6.0Whois","type":"object","description":"The resources of a WHOIS record for a given domain. This can include domain names, IP address blocks, autonomous system information, and/or contact and registration information for a domain.","properties":{"autonomous_system":{"$ref":"#/components/schemas/ocsfv1.6.0AutonomousSystem","nullable":true,"description":"The autonomous system information associated with a domain."},"created_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"When the domain was registered or WHOIS entry was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"When the domain was registered or WHOIS entry was created."},"dnssec_status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized value of dnssec_status_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"dnssec_status_id":{"$ref":"#/components/schemas/ocsfv1.6.0Whois_DnssecStatusId","nullable":true,"description":"Describes the normalized status of DNS Security Extensions (DNSSEC) for a domain."},"domain":{"type":"string","nullable":true,"description":"The domain name corresponding to the WHOIS record."},"domain_contacts":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.6.0DomainContact"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Domain Contact"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects."},"children":[],"type":"text"}],"type":"paragraph"}]},"email_addr":{"$ref":"#/components/schemas/ocsfv1.6.0EmailAddress","nullable":true,"description":"The email address for the registrar's abuse contact"},"isp":{"type":"string","nullable":true,"description":"The name of the Internet Service Provider (ISP)."},"isp_org":{"type":"string","nullable":true,"description":"The organization name of the Internet Service Provider (ISP). This represents the parent organization or company that owns/operates the ISP. For example, Comcast Corporation would be the ISP org for Xfinity internet service. This attribute helps identify the ultimate provider when ISPs operate under different brand names."},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.6.0Timestamp","nullable":true,"description":"When the WHOIS record was last updated or seen at."},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"When the WHOIS record was last updated or seen at."},"name_servers":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A collection of name servers related to a domain registration or other record."},"phone_number":{"type":"string","nullable":true,"description":"The phone number for the registrar's abuse contact"},"registrar":{"type":"string","nullable":true,"description":"The domain registrar."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The status of a domain and its ability to be transferred, e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"clientTransferProhibited"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"subdomains":{"type":"array","items":{"type":"string"},"nullable":true,"description":"An array of subdomain strings. Can be used to collect several subdomains such as those from Domain Generation Algorithms (DGAs)."},"subnet":{"$ref":"#/components/schemas/ocsfv1.6.0Subnet","nullable":true,"description":"The IP address block (CIDR) associated with a domain."}}}},"components/schemas/ocsfv1.6.0Whois_DnssecStatusId":{"id":"components/schemas/ocsfv1.6.0Whois_DnssecStatusId","kind":"json-schema","title":"ocsfv1.6.0Whois_DnssecStatusId","data":{"title":"ocsfv1.6.0Whois_DnssecStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"WhoisDnssecStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Signed: The related domain enables the signing of DNS records using DNSSEC."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Unsigned: The related domain does not enable the signing of DNS records using DNSSEC."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The DNSSEC status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dnssec_status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0accessgrantinventoryinfoAccessGrantInventoryInfo":{"id":"components/schemas/ocsfv1.8.0accessgrantinventoryinfoAccessGrantInventoryInfo","kind":"json-schema","title":"ocsfv1.8.0accessgrantinventoryinfoAccessGrantInventoryInfo","data":{"title":"ocsfv1.8.0accessgrantinventoryinfoAccessGrantInventoryInfo","type":"object","description":"Access Grant Inventory Info events report access grant inventory data that is either logged or proactively collected. An access grant is standing access held by a principal, such as permissions or scopes granted to an application, or a principal assigned to an application or resource. Each event reports one grant. For example, when listing the OAuth consent grants and application role assignments in an identity provider tenant.","properties":{"access_grant":{"$ref":"#/components/schemas/ocsfv1.8.0AccessGrant","description":"The access grant that was discovered."},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0accessgrantinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.8.0Actor","nullable":true,"description":"The actor describes the process or service that collected the access grant inventory."},"application":{"$ref":"#/components/schemas/ocsfv1.8.0Application","nullable":true,"description":"The client application that exercises the grant. For a delegated permission, the application acting on behalf of the principal; for an application permission, the application that is also the principal."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0accessgrantinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0accessgrantinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"principal":{"$ref":"#/components/schemas/ocsfv1.8.0Principal","description":"The security principal that holds the grant."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0accessgrantinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0accessgrantinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time, or the time when the inventory was collected."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time, or the time when the inventory was collected."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0accessgrantinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["access_grant","activity_id","category_uid","class_uid","metadata","principal","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0accessgrantinventoryinfoActivityId":{"id":"components/schemas/ocsfv1.8.0accessgrantinventoryinfoActivityId","kind":"json-schema","title":"ocsfv1.8.0accessgrantinventoryinfoActivityId","data":{"title":"ocsfv1.8.0accessgrantinventoryinfoActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Log: The discovered information is via a log."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Collect: The discovered information is via a collection process."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0accessgrantinventoryinfoCategoryUid":{"id":"components/schemas/ocsfv1.8.0accessgrantinventoryinfoCategoryUid","kind":"json-schema","title":"ocsfv1.8.0accessgrantinventoryinfoCategoryUid","data":{"title":"ocsfv1.8.0accessgrantinventoryinfoCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects."}},"components/schemas/ocsfv1.8.0accessgrantinventoryinfoClassUid":{"id":"components/schemas/ocsfv1.8.0accessgrantinventoryinfoClassUid","kind":"json-schema","title":"ocsfv1.8.0accessgrantinventoryinfoClassUid","data":{"title":"ocsfv1.8.0accessgrantinventoryinfoClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n98905008 - AccessGrantInventoryInfo: Access Grant Inventory Info events report access grant inventory data that is either logged or proactively collected. An access grant is standing access held by a principal, such as permissions or scopes granted to an application, or a principal assigned to an application or resource. Each event reports one grant. For example, when listing the OAuth consent grants and application role assignments in an identity provider tenant."}},"components/schemas/ocsfv1.8.0accessgrantinventoryinfoSeverityId":{"id":"components/schemas/ocsfv1.8.0accessgrantinventoryinfoSeverityId","kind":"json-schema","title":"ocsfv1.8.0accessgrantinventoryinfoSeverityId","data":{"title":"ocsfv1.8.0accessgrantinventoryinfoSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0accessgrantinventoryinfoStatusId":{"id":"components/schemas/ocsfv1.8.0accessgrantinventoryinfoStatusId","kind":"json-schema","title":"ocsfv1.8.0accessgrantinventoryinfoStatusId","data":{"title":"ocsfv1.8.0accessgrantinventoryinfoStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0accessgrantinventoryinfoTypeUid":{"id":"components/schemas/ocsfv1.8.0accessgrantinventoryinfoTypeUid","kind":"json-schema","title":"ocsfv1.8.0accessgrantinventoryinfoTypeUid","data":{"title":"ocsfv1.8.0accessgrantinventoryinfoTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n9890500800 - Unknown\n9890500801 - Log: The discovered information is via a log.\n9890500802 - Collect: The discovered information is via a collection process.\n9890500899 - Other"}},"components/schemas/ocsfv1.8.0applicationinventoryinfoActivityId":{"id":"components/schemas/ocsfv1.8.0applicationinventoryinfoActivityId","kind":"json-schema","title":"ocsfv1.8.0applicationinventoryinfoActivityId","data":{"title":"ocsfv1.8.0applicationinventoryinfoActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Log: The discovered information is via a log."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Collect: The discovered information is via a collection process."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0applicationinventoryinfoApplicationInventoryInfo":{"id":"components/schemas/ocsfv1.8.0applicationinventoryinfoApplicationInventoryInfo","kind":"json-schema","title":"ocsfv1.8.0applicationinventoryinfoApplicationInventoryInfo","data":{"title":"ocsfv1.8.0applicationinventoryinfoApplicationInventoryInfo","type":"object","description":"Application Inventory Info events report application inventory information that is either logged or proactively collected. For example, when collecting application information from a CMDB, running a network sweep of connected applications, or when scanning an application with a application security tool.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"application":{"$ref":"#/components/schemas/ocsfv1.8.0Application","description":"The application that was discovered."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0applicationinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0applicationinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"criticality":{"type":"string","nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.criticality attribute instead."},"data":{"nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.data attribute instead."},"desc":{"type":"string","nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.desc attribute instead."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"group":{"$ref":"#/components/schemas/ocsfv1.8.0Group","nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.group attribute instead."},"hostname":{"$ref":"#/components/schemas/ocsfv1.8.0Hostname","nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.hostname attribute instead."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"name":{"type":"string","nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.name attribute instead."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"owner":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.owner attribute instead."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This field is deprecated and will be removed in a future sdk version. Use the application.risk_level attribute instead."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationinventoryinfoRiskLevelId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This field is deprecated and will be removed in a future sdk version. Use the application.risk_level_id attribute instead."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_score":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This field is deprecated and will be removed in a future sdk version. Use the application.risk_score attribute instead."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KeyValueObject"},"nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.tags attribute instead."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the application creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the application creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.type attribute instead."},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0applicationinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.uid attribute instead."},"uid_alt":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This field is deprecated and will be removed in a future sdk version. Use the application.uid_alt attribute instead."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"url":{"$ref":"#/components/schemas/ocsfv1.8.0Url","nullable":true,"description":"This field is deprecated and will be removed in a future sdk version. Use the application.url attribute instead."}},"required":["activity_id","application","category_uid","class_uid","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0applicationinventoryinfoCategoryUid":{"id":"components/schemas/ocsfv1.8.0applicationinventoryinfoCategoryUid","kind":"json-schema","title":"ocsfv1.8.0applicationinventoryinfoCategoryUid","data":{"title":"ocsfv1.8.0applicationinventoryinfoCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects."}},"components/schemas/ocsfv1.8.0applicationinventoryinfoClassUid":{"id":"components/schemas/ocsfv1.8.0applicationinventoryinfoClassUid","kind":"json-schema","title":"ocsfv1.8.0applicationinventoryinfoClassUid","data":{"title":"ocsfv1.8.0applicationinventoryinfoClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n98905001 - ApplicationInventoryInfo: Application Inventory Info events report application inventory information that is either logged or proactively collected. For example, when collecting application information from a CMDB, running a network sweep of connected applications, or when scanning an application with a application security tool."}},"components/schemas/ocsfv1.8.0applicationinventoryinfoRiskLevelId":{"id":"components/schemas/ocsfv1.8.0applicationinventoryinfoRiskLevelId","kind":"json-schema","title":"ocsfv1.8.0applicationinventoryinfoRiskLevelId","data":{"title":"ocsfv1.8.0applicationinventoryinfoRiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0applicationinventoryinfoSeverityId":{"id":"components/schemas/ocsfv1.8.0applicationinventoryinfoSeverityId","kind":"json-schema","title":"ocsfv1.8.0applicationinventoryinfoSeverityId","data":{"title":"ocsfv1.8.0applicationinventoryinfoSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0applicationinventoryinfoStatusId":{"id":"components/schemas/ocsfv1.8.0applicationinventoryinfoStatusId","kind":"json-schema","title":"ocsfv1.8.0applicationinventoryinfoStatusId","data":{"title":"ocsfv1.8.0applicationinventoryinfoStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0applicationinventoryinfoTypeUid":{"id":"components/schemas/ocsfv1.8.0applicationinventoryinfoTypeUid","kind":"json-schema","title":"ocsfv1.8.0applicationinventoryinfoTypeUid","data":{"title":"ocsfv1.8.0applicationinventoryinfoTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n9890500100 - Unknown\n9890500101 - Log: The discovered information is via a log.\n9890500102 - Collect: The discovered information is via a collection process.\n9890500199 - Other"}},"components/schemas/ocsfv1.8.0applicationsecurityposturefindingActionId":{"id":"components/schemas/ocsfv1.8.0applicationsecurityposturefindingActionId","kind":"json-schema","title":"ocsfv1.8.0applicationsecurityposturefindingActionId","data":{"title":"ocsfv1.8.0applicationsecurityposturefindingActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Observed: The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Modified: The activity was modified, adjusted, or corrected. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0applicationsecurityposturefindingActivityId":{"id":"components/schemas/ocsfv1.8.0applicationsecurityposturefindingActivityId","kind":"json-schema","title":"ocsfv1.8.0applicationsecurityposturefindingActivityId","data":{"title":"ocsfv1.8.0applicationsecurityposturefindingActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Create: A finding was created."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Update: A finding was updated."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Close: A finding was closed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0applicationsecurityposturefindingApplicationSecurityPostureFinding":{"id":"components/schemas/ocsfv1.8.0applicationsecurityposturefindingApplicationSecurityPostureFinding","kind":"json-schema","title":"ocsfv1.8.0applicationsecurityposturefindingApplicationSecurityPostureFinding","data":{"title":"ocsfv1.8.0applicationsecurityposturefindingApplicationSecurityPostureFinding","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Application Security Posture Finding event is a notification about any bug, defect, deficiency, exploit, vulnerability, weakness or any other issue with software and related systems. Application Security Posture Findings typically involve reporting on the greater context including compliance, impacted resources, remediation guidance, specific code defects, and/or vulnerability metadata. Application Security Posture Findings can be reported by Threat & Vulnerability Management (TVM) tools, Application Security Posture Management (ASPM) tools, or other similar tools. Note: if the event producer is a security control, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile should be applied and its "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"attacks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" information, if present, should be duplicated into the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note: "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the Finding is an incident, i.e. requires incident workflow, also apply the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"incident"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile or aggregate this finding into an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Incident Finding"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingActivityId","description":"The normalized identifier of the finding activity."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The finding activity name, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"application":{"$ref":"#/components/schemas/ocsfv1.8.0Application","nullable":true,"description":"An Application describes the details for an inventoried application as reported by an Application Security tool or other Developer-centric tooling. Applications can be defined as Kubernetes resources, Containerized resources, or application hosting-specific cloud sources such as AWS Elastic BeanStalk, AWS Lightsail, or Azure Logic Apps."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"comment":{"type":"string","nullable":true,"description":"A user provided comment about the finding."},"compliance":{"$ref":"#/components/schemas/ocsfv1.8.0Compliance","nullable":true,"description":"Provides compliance context to vulnerabilities and other weaknesses that are reported as part of an Application Security or Vulnerability Management tool's built-in compliance framework mapping."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"device":{"$ref":"#/components/schemas/ocsfv1.8.0Device","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the affected device/host. If applicable, it can be used in conjunction with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Resource(s)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. Specific details about an AWS EC2 instance, that is affected by the Finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the most recent event included in the finding."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the most recent event included in the finding."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"finding_info":{"$ref":"#/components/schemas/ocsfv1.8.0FindingInfo","description":"Describes the supporting information about a generated finding."},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"remediation":{"$ref":"#/components/schemas/ocsfv1.8.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified vulnerabilities or weaknesses."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails"},"nullable":true,"description":"Describes details about the resource/resources that are affected by the vulnerability/vulnerabilities."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the least recent event included in the finding."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the least recent event included in the finding."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingStatusId","nullable":true,"description":"The normalized status identifier of the Finding, set by the consumer."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0applicationsecurityposturefindingTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"vendor_attributes":{"$ref":"#/components/schemas/ocsfv1.8.0VendorAttributes","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability."},"children":[],"type":"text"}],"type":"paragraph"}]},"vulnerabilities":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Vulnerability"},"nullable":true,"description":"This object describes vulnerabilities reported in a security finding."}},"required":["activity_id","category_uid","class_uid","finding_info","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0applicationsecurityposturefindingCategoryUid":{"id":"components/schemas/ocsfv1.8.0applicationsecurityposturefindingCategoryUid","kind":"json-schema","title":"ocsfv1.8.0applicationsecurityposturefindingCategoryUid","data":{"title":"ocsfv1.8.0applicationsecurityposturefindingCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n2 - Findings: Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products."}},"components/schemas/ocsfv1.8.0applicationsecurityposturefindingClassUid":{"id":"components/schemas/ocsfv1.8.0applicationsecurityposturefindingClassUid","kind":"json-schema","title":"ocsfv1.8.0applicationsecurityposturefindingClassUid","data":{"title":"ocsfv1.8.0applicationsecurityposturefindingClassUid","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ClassUid is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2007 - ApplicationSecurityPostureFinding: The Application Security Posture Finding event is a notification about any bug, defect, deficiency, exploit, vulnerability, weakness or any other issue with software and related systems. Application Security Posture Findings typically involve reporting on the greater context including compliance, impacted resources, remediation guidance, specific code defects, and/or vulnerability metadata. Application Security Posture Findings can be reported by Threat & Vulnerability Management (TVM) tools, Application Security Posture Management (ASPM) tools, or other similar tools. Note: if the event producer is a security control, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile should be applied and its "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"attacks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" information, if present, should be duplicated into the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note: "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the Finding is an incident, i.e. requires incident workflow, also apply the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"incident"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile or aggregate this finding into an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Incident Finding"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0applicationsecurityposturefindingConfidenceId":{"id":"components/schemas/ocsfv1.8.0applicationsecurityposturefindingConfidenceId","kind":"json-schema","title":"ocsfv1.8.0applicationsecurityposturefindingConfidenceId","data":{"title":"ocsfv1.8.0applicationsecurityposturefindingConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0applicationsecurityposturefindingDispositionId":{"id":"components/schemas/ocsfv1.8.0applicationsecurityposturefindingDispositionId","kind":"json-schema","title":"ocsfv1.8.0applicationsecurityposturefindingDispositionId","data":{"title":"ocsfv1.8.0applicationsecurityposturefindingDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0applicationsecurityposturefindingRiskLevelId":{"id":"components/schemas/ocsfv1.8.0applicationsecurityposturefindingRiskLevelId","kind":"json-schema","title":"ocsfv1.8.0applicationsecurityposturefindingRiskLevelId","data":{"title":"ocsfv1.8.0applicationsecurityposturefindingRiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0applicationsecurityposturefindingSeverityId":{"id":"components/schemas/ocsfv1.8.0applicationsecurityposturefindingSeverityId","kind":"json-schema","title":"ocsfv1.8.0applicationsecurityposturefindingSeverityId","data":{"title":"ocsfv1.8.0applicationsecurityposturefindingSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0applicationsecurityposturefindingStatusId":{"id":"components/schemas/ocsfv1.8.0applicationsecurityposturefindingStatusId","kind":"json-schema","title":"ocsfv1.8.0applicationsecurityposturefindingStatusId","data":{"title":"ocsfv1.8.0applicationsecurityposturefindingStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - New: The Finding is new and yet to be reviewed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - InProgress: The Finding is under review."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Suppressed: The Finding was reviewed, determined to be benign or a false positive and is now suppressed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Resolved: The Finding was reviewed, remediated and is now considered resolved."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Archived: The Finding was archived."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Deleted: The Finding was deleted. For example, it might have been created in error."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0applicationsecurityposturefindingTypeUid":{"id":"components/schemas/ocsfv1.8.0applicationsecurityposturefindingTypeUid","kind":"json-schema","title":"ocsfv1.8.0applicationsecurityposturefindingTypeUid","data":{"title":"ocsfv1.8.0applicationsecurityposturefindingTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n200700 - Unknown\n200701 - Create: A finding was created.\n200702 - Update: A finding was updated.\n200703 - Close: A finding was closed.\n200799 - Other"}},"components/schemas/ocsfv1.8.0EmailAddress":{"id":"components/schemas/ocsfv1.8.0EmailAddress","kind":"json-schema","title":"ocsfv1.8.0EmailAddress","data":{"title":"ocsfv1.8.0EmailAddress","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Email address. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"john_doe@example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0FileName":{"id":"components/schemas/ocsfv1.8.0FileName","kind":"json-schema","title":"ocsfv1.8.0FileName","data":{"title":"ocsfv1.8.0FileName","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"File name. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"text-file.txt"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0FilePath":{"id":"components/schemas/ocsfv1.8.0FilePath","kind":"json-schema","title":"ocsfv1.8.0FilePath","data":{"title":"ocsfv1.8.0FilePath","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full path to the file. For example: For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"c:\\windows\\system32\\svchost.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Hash":{"id":"components/schemas/ocsfv1.8.0Hash","kind":"json-schema","title":"ocsfv1.8.0Hash","data":{"title":"ocsfv1.8.0Hash","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Fingerprint. A value, in any format, that maps an arbitrarily large data item to a much shorter string that uniquely identifies the original data. Examples include cryptographic hashing of a file, code signing, and Network Protocol Fingerprinting (NPF)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note about name."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" The type name "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"file_hast_t"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and the caption \"Hash\" are used for legacy reasons. This type has been generalized from a file hash to a general fingerprint. The existing type name and caption were retained for backwards compatibility."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Hostname":{"id":"components/schemas/ocsfv1.8.0Hostname","kind":"json-schema","title":"ocsfv1.8.0Hostname","data":{"title":"ocsfv1.8.0Hostname","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Unique name assigned to a device connected to a computer network. It may be a fully qualified domain name (FQDN). For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"r2-d2.example.com."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":","},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mx.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0IPAddress":{"id":"components/schemas/ocsfv1.8.0IPAddress","kind":"json-schema","title":"ocsfv1.8.0IPAddress","data":{"title":"ocsfv1.8.0IPAddress","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Internet Protocol address (IP address), in either IPv4 or IPv6 format. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"192.168.200.24"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2001:0db8:85a3:0000:0000:8a2e:0370:7334"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0MACAddress":{"id":"components/schemas/ocsfv1.8.0MACAddress","kind":"json-schema","title":"ocsfv1.8.0MACAddress","data":{"title":"ocsfv1.8.0MACAddress","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Media Access Control (MAC) address. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"18:36:F3:98:4F:9A"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Port":{"id":"components/schemas/ocsfv1.8.0Port","kind":"json-schema","title":"ocsfv1.8.0Port","data":{"title":"ocsfv1.8.0Port","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The TCP/UDP port number. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"80"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":","},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"22"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0ProcessName":{"id":"components/schemas/ocsfv1.8.0ProcessName","kind":"json-schema","title":"ocsfv1.8.0ProcessName","data":{"title":"ocsfv1.8.0ProcessName","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Process name. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notepad"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0ResourceUID":{"id":"components/schemas/ocsfv1.8.0ResourceUID","kind":"json-schema","title":"ocsfv1.8.0ResourceUID","data":{"title":"ocsfv1.8.0ResourceUID","type":"string","description":"Resource unique identifier. For example, S3 Bucket name or EC2 Instance ID."}},"components/schemas/ocsfv1.8.0Subnet":{"id":"components/schemas/ocsfv1.8.0Subnet","kind":"json-schema","title":"ocsfv1.8.0Subnet","data":{"title":"ocsfv1.8.0Subnet","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The subnet represented in a CIDR notation, using the format network_address/prefix_length. The network_address can be in either IPv4 or IPv6 format. The prefix length indicates the number of bits used for the network portion, and the remaining bits are available for host addresses within that subnet. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"192.168.1.0/24"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":","},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2001:0db8:85a3:0000::/64"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Timestamp":{"id":"components/schemas/ocsfv1.8.0Timestamp","kind":"json-schema","title":"ocsfv1.8.0Timestamp","data":{"title":"ocsfv1.8.0Timestamp","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1618524549901"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0URLString":{"id":"components/schemas/ocsfv1.8.0URLString","kind":"json-schema","title":"ocsfv1.8.0URLString","data":{"title":"ocsfv1.8.0URLString","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Uniform Resource Locator (URL) string. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http://www.example.com/download/trouble.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0UserName":{"id":"components/schemas/ocsfv1.8.0UserName","kind":"json-schema","title":"ocsfv1.8.0UserName","data":{"title":"ocsfv1.8.0UserName","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User name. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"john_doe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0chatmessageactivityActivityId":{"id":"components/schemas/ocsfv1.8.0chatmessageactivityActivityId","kind":"json-schema","title":"ocsfv1.8.0chatmessageactivityActivityId","data":{"title":"ocsfv1.8.0chatmessageactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Send: A message was sent by a user to a conversation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Receive: A message was received (e.g. an AI-generated response)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Edit: An existing message was edited."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Delete: A message was deleted from the conversation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - React: A user added a reaction to a message."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - SystemEvent: A system event occurred in the conversation (e.g. member added, settings changed)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0chatmessageactivityCategoryUid":{"id":"components/schemas/ocsfv1.8.0chatmessageactivityCategoryUid","kind":"json-schema","title":"ocsfv1.8.0chatmessageactivityCategoryUid","data":{"title":"ocsfv1.8.0chatmessageactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n6 - ApplicationActivity: Application Activity events report detailed information about the behavior of applications and services."}},"components/schemas/ocsfv1.8.0chatmessageactivityChatMessageActivity":{"id":"components/schemas/ocsfv1.8.0chatmessageactivityChatMessageActivity","kind":"json-schema","title":"ocsfv1.8.0chatmessageactivityChatMessageActivity","data":{"title":"ocsfv1.8.0chatmessageactivityChatMessageActivity","type":"object","description":"Chat Message Activity events report messages sent and received in enterprise chat platforms such as Microsoft Teams, Slack, or AI assistants like Microsoft 365 Copilot.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0chatmessageactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.8.0Actor","nullable":true,"description":"The actor that sent or generated the message."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Application Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0chatmessageactivityCategoryUid","description":"The category unique identifier of the event."},"chat_message":{"$ref":"#/components/schemas/ocsfv1.8.0ChatMessage","description":"The details of the chat message."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0chatmessageactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0chatmessageactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0chatmessageactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0chatmessageactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","chat_message","class_uid","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0chatmessageactivityClassUid":{"id":"components/schemas/ocsfv1.8.0chatmessageactivityClassUid","kind":"json-schema","title":"ocsfv1.8.0chatmessageactivityClassUid","data":{"title":"ocsfv1.8.0chatmessageactivityClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n98906002 - ChatMessageActivity: Chat Message Activity events report messages sent and received in enterprise chat platforms such as Microsoft Teams, Slack, or AI assistants like Microsoft 365 Copilot."}},"components/schemas/ocsfv1.8.0chatmessageactivitySeverityId":{"id":"components/schemas/ocsfv1.8.0chatmessageactivitySeverityId","kind":"json-schema","title":"ocsfv1.8.0chatmessageactivitySeverityId","data":{"title":"ocsfv1.8.0chatmessageactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0chatmessageactivityStatusId":{"id":"components/schemas/ocsfv1.8.0chatmessageactivityStatusId","kind":"json-schema","title":"ocsfv1.8.0chatmessageactivityStatusId","data":{"title":"ocsfv1.8.0chatmessageactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0chatmessageactivityTypeUid":{"id":"components/schemas/ocsfv1.8.0chatmessageactivityTypeUid","kind":"json-schema","title":"ocsfv1.8.0chatmessageactivityTypeUid","data":{"title":"ocsfv1.8.0chatmessageactivityTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n9890600200 - Unknown\n9890600201 - Send: A message was sent by a user to a conversation.\n9890600202 - Receive: A message was received (e.g. an AI-generated response).\n9890600203 - Edit: An existing message was edited.\n9890600204 - Delete: A message was deleted from the conversation.\n9890600205 - React: A user added a reaction to a message.\n9890600206 - SystemEvent: A system event occurred in the conversation (e.g. member added, settings changed).\n9890600299 - Other"}},"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoActionId":{"id":"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoActionId","kind":"json-schema","title":"ocsfv1.8.0cloudresourcesinventoryinfoActionId","data":{"title":"ocsfv1.8.0cloudresourcesinventoryinfoActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Observed: The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Modified: The activity was modified, adjusted, or corrected. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoActivityId":{"id":"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoActivityId","kind":"json-schema","title":"ocsfv1.8.0cloudresourcesinventoryinfoActivityId","data":{"title":"ocsfv1.8.0cloudresourcesinventoryinfoActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Log: The discovered information is via a log."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Collect: The discovered information is via a collection process."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoCategoryUid":{"id":"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoCategoryUid","kind":"json-schema","title":"ocsfv1.8.0cloudresourcesinventoryinfoCategoryUid","data":{"title":"ocsfv1.8.0cloudresourcesinventoryinfoCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects."}},"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoClassUid":{"id":"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoClassUid","kind":"json-schema","title":"ocsfv1.8.0cloudresourcesinventoryinfoClassUid","data":{"title":"ocsfv1.8.0cloudresourcesinventoryinfoClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n5023 - CloudResourcesInventoryInfo: Cloud Resources Inventory Info events report cloud asset inventory data. This data can be either logged or proactively collected. For example, use this event class when creating an inventory of cloud resource information from a Configuration Management Database (CMDB), Cyber Asset Attack Surface Management (CAASM), direct public cloud service provider APIs, Software-as-a-Service (SaaS) APIs, or otherwise."}},"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo":{"id":"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo","kind":"json-schema","title":"ocsfv1.8.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo","data":{"title":"ocsfv1.8.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo","type":"object","description":"Cloud Resources Inventory Info events report cloud asset inventory data. This data can be either logged or proactively collected. For example, use this event class when creating an inventory of cloud resource information from a Configuration Management Database (CMDB), Cyber Asset Attack Surface Management (CAASM), direct public cloud service provider APIs, Software-as-a-Service (SaaS) APIs, or otherwise.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.8.0Cloud","nullable":true,"description":"Cloud service provider or SaaS platform metadata about the cloud resource(s) that are being discovered by an inventory process."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"container":{"$ref":"#/components/schemas/ocsfv1.8.0Container","nullable":true,"description":"A cloud-based container image or running container discovered by an inventory process."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"database":{"$ref":"#/components/schemas/ocsfv1.8.0Database","nullable":true,"description":"A cloud-based database discovered by an inventory process."},"databucket":{"$ref":"#/components/schemas/ocsfv1.8.0Databucket","nullable":true,"description":"A cloud-based data bucket or other object storage discovered by an inventory process."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"idp":{"$ref":"#/components/schemas/ocsfv1.8.0Idp","nullable":true,"description":"The Identity Provider that is being discovered by an inventory process, or that is related to the cloud resource(s) being discovered by an inventory process."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"region":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cloud region where the resource is located, e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-isof-south-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"eastus2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-central1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", etc."},"children":[],"type":"text"}],"type":"paragraph"}]},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails"},"nullable":true,"description":"The cloud resource(s) that are being discovered by an inventory process. Use this object if there is not a direct object match in the class."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"table":{"$ref":"#/components/schemas/ocsfv1.8.0Table","nullable":true,"description":"A cloud-based database table discovered by an inventory process."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoConfidenceId":{"id":"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoConfidenceId","kind":"json-schema","title":"ocsfv1.8.0cloudresourcesinventoryinfoConfidenceId","data":{"title":"ocsfv1.8.0cloudresourcesinventoryinfoConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoDispositionId":{"id":"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoDispositionId","kind":"json-schema","title":"ocsfv1.8.0cloudresourcesinventoryinfoDispositionId","data":{"title":"ocsfv1.8.0cloudresourcesinventoryinfoDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoRiskLevelId":{"id":"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoRiskLevelId","kind":"json-schema","title":"ocsfv1.8.0cloudresourcesinventoryinfoRiskLevelId","data":{"title":"ocsfv1.8.0cloudresourcesinventoryinfoRiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoSeverityId":{"id":"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoSeverityId","kind":"json-schema","title":"ocsfv1.8.0cloudresourcesinventoryinfoSeverityId","data":{"title":"ocsfv1.8.0cloudresourcesinventoryinfoSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoStatusId":{"id":"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoStatusId","kind":"json-schema","title":"ocsfv1.8.0cloudresourcesinventoryinfoStatusId","data":{"title":"ocsfv1.8.0cloudresourcesinventoryinfoStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoTypeUid":{"id":"components/schemas/ocsfv1.8.0cloudresourcesinventoryinfoTypeUid","kind":"json-schema","title":"ocsfv1.8.0cloudresourcesinventoryinfoTypeUid","data":{"title":"ocsfv1.8.0cloudresourcesinventoryinfoTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n502300 - Unknown\n502301 - Log: The discovered information is via a log.\n502302 - Collect: The discovered information is via a collection process.\n502399 - Other"}},"components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoActivityId":{"id":"components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoActivityId","kind":"json-schema","title":"ocsfv1.8.0compliancecontrolinventoryinfoActivityId","data":{"title":"ocsfv1.8.0compliancecontrolinventoryinfoActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Log: The discovered information is via a log."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Collect: The discovered information is via a collection process."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoCategoryUid":{"id":"components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoCategoryUid","kind":"json-schema","title":"ocsfv1.8.0compliancecontrolinventoryinfoCategoryUid","data":{"title":"ocsfv1.8.0compliancecontrolinventoryinfoCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects."}},"components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoClassUid":{"id":"components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoClassUid","kind":"json-schema","title":"ocsfv1.8.0compliancecontrolinventoryinfoClassUid","data":{"title":"ocsfv1.8.0compliancecontrolinventoryinfoClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n98905004 - ComplianceControlInventoryInfo: Compliance Control Inventory Info events report the compliance controls defined in a GRC platform, along with their framework mappings and current status. For example, when listing the controls tracked in a compliance-automation tool."}},"components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoComplianceControlInventoryInfo":{"id":"components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoComplianceControlInventoryInfo","kind":"json-schema","title":"ocsfv1.8.0compliancecontrolinventoryinfoComplianceControlInventoryInfo","data":{"title":"ocsfv1.8.0compliancecontrolinventoryinfoComplianceControlInventoryInfo","type":"object","description":"Compliance Control Inventory Info events report the compliance controls defined in a GRC platform, along with their framework mappings and current status. For example, when listing the controls tracked in a compliance-automation tool.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"compliance_control":{"$ref":"#/components/schemas/ocsfv1.8.0ComplianceControl","description":"The compliance control that was discovered."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time, or the time the control inventory was collected."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time, or the time the control inventory was collected."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","compliance_control","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoSeverityId":{"id":"components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoSeverityId","kind":"json-schema","title":"ocsfv1.8.0compliancecontrolinventoryinfoSeverityId","data":{"title":"ocsfv1.8.0compliancecontrolinventoryinfoSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoStatusId":{"id":"components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoStatusId","kind":"json-schema","title":"ocsfv1.8.0compliancecontrolinventoryinfoStatusId","data":{"title":"ocsfv1.8.0compliancecontrolinventoryinfoStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoTypeUid":{"id":"components/schemas/ocsfv1.8.0compliancecontrolinventoryinfoTypeUid","kind":"json-schema","title":"ocsfv1.8.0compliancecontrolinventoryinfoTypeUid","data":{"title":"ocsfv1.8.0compliancecontrolinventoryinfoTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n9890500400 - Unknown\n9890500401 - Log: The discovered information is via a log.\n9890500402 - Collect: The discovered information is via a collection process.\n9890500499 - Other"}},"components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoActivityId":{"id":"components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoActivityId","kind":"json-schema","title":"ocsfv1.8.0complianceevidenceinventoryinfoActivityId","data":{"title":"ocsfv1.8.0complianceevidenceinventoryinfoActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Log: The discovered information is via a log."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Collect: The discovered information is via a collection process."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoCategoryUid":{"id":"components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoCategoryUid","kind":"json-schema","title":"ocsfv1.8.0complianceevidenceinventoryinfoCategoryUid","data":{"title":"ocsfv1.8.0complianceevidenceinventoryinfoCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects."}},"components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoClassUid":{"id":"components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoClassUid","kind":"json-schema","title":"ocsfv1.8.0complianceevidenceinventoryinfoClassUid","data":{"title":"ocsfv1.8.0complianceevidenceinventoryinfoClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n98905006 - ComplianceEvidenceInventoryInfo: Compliance Evidence Inventory Info events report the documentation artifacts collected in a GRC platform to prove controls are working, along with the controls or tests they support. For example, when listing the evidence attached to tests in a compliance-automation tool."}},"components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoComplianceEvidenceInventoryInfo":{"id":"components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoComplianceEvidenceInventoryInfo","kind":"json-schema","title":"ocsfv1.8.0complianceevidenceinventoryinfoComplianceEvidenceInventoryInfo","data":{"title":"ocsfv1.8.0complianceevidenceinventoryinfoComplianceEvidenceInventoryInfo","type":"object","description":"Compliance Evidence Inventory Info events report the documentation artifacts collected in a GRC platform to prove controls are working, along with the controls or tests they support. For example, when listing the evidence attached to tests in a compliance-automation tool.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"compliance_evidence":{"$ref":"#/components/schemas/ocsfv1.8.0ComplianceEvidence","description":"The compliance evidence that was discovered."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time, or the time the evidence inventory was collected."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time, or the time the evidence inventory was collected."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","compliance_evidence","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoSeverityId":{"id":"components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoSeverityId","kind":"json-schema","title":"ocsfv1.8.0complianceevidenceinventoryinfoSeverityId","data":{"title":"ocsfv1.8.0complianceevidenceinventoryinfoSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoStatusId":{"id":"components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoStatusId","kind":"json-schema","title":"ocsfv1.8.0complianceevidenceinventoryinfoStatusId","data":{"title":"ocsfv1.8.0complianceevidenceinventoryinfoStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoTypeUid":{"id":"components/schemas/ocsfv1.8.0complianceevidenceinventoryinfoTypeUid","kind":"json-schema","title":"ocsfv1.8.0complianceevidenceinventoryinfoTypeUid","data":{"title":"ocsfv1.8.0complianceevidenceinventoryinfoTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n9890500600 - Unknown\n9890500601 - Log: The discovered information is via a log.\n9890500602 - Collect: The discovered information is via a collection process.\n9890500699 - Other"}},"components/schemas/ocsfv1.8.0compliancefindingActivityId":{"id":"components/schemas/ocsfv1.8.0compliancefindingActivityId","kind":"json-schema","title":"ocsfv1.8.0compliancefindingActivityId","data":{"title":"ocsfv1.8.0compliancefindingActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Create: A finding was created."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Update: A finding was updated."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Close: A finding was closed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0compliancefindingCategoryUid":{"id":"components/schemas/ocsfv1.8.0compliancefindingCategoryUid","kind":"json-schema","title":"ocsfv1.8.0compliancefindingCategoryUid","data":{"title":"ocsfv1.8.0compliancefindingCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n2 - Findings: Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products."}},"components/schemas/ocsfv1.8.0compliancefindingClassUid":{"id":"components/schemas/ocsfv1.8.0compliancefindingClassUid","kind":"json-schema","title":"ocsfv1.8.0compliancefindingClassUid","data":{"title":"ocsfv1.8.0compliancefindingClassUid","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ClassUid is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2003 - ComplianceFinding: Compliance Finding events describe results of evaluations performed against resources, to check compliance with various Industry Frameworks or Security Standards such as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST SP 800-53, CIS AWS Foundations Benchmark v1.4.0, ISO/IEC 27001"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" etc. Note: if the event producer is a security control, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile should be applied and its "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"attacks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" information, if present, should be duplicated into the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note: "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the Finding is an incident, i.e. requires incident workflow, also apply the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"incident"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile or aggregate this finding into an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Incident Finding"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0compliancefindingComplianceFinding":{"id":"components/schemas/ocsfv1.8.0compliancefindingComplianceFinding","kind":"json-schema","title":"ocsfv1.8.0compliancefindingComplianceFinding","data":{"title":"ocsfv1.8.0compliancefindingComplianceFinding","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Compliance Finding events describe results of evaluations performed against resources, to check compliance with various Industry Frameworks or Security Standards such as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST SP 800-53, CIS AWS Foundations Benchmark v1.4.0, ISO/IEC 27001"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" etc. Note: if the event producer is a security control, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile should be applied and its "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"attacks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" information, if present, should be duplicated into the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note: "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the Finding is an incident, i.e. requires incident workflow, also apply the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"incident"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile or aggregate this finding into an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Incident Finding"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancefindingActivityId","description":"The normalized identifier of the finding activity."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The finding activity name, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0compliancefindingCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0compliancefindingClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"comment":{"type":"string","nullable":true,"description":"A user provided comment about the finding."},"compliance":{"$ref":"#/components/schemas/ocsfv1.8.0Compliance","description":"The compliance object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS, NIST etc.) and contains compliance related details."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancefindingConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"device":{"$ref":"#/components/schemas/ocsfv1.8.0Device","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the affected device/host. If applicable, it can be used in conjunction with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Resource(s)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. Specific details about an AWS EC2 instance, that is affected by the Finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the most recent event included in the finding."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the most recent event included in the finding."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"evidences":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Evidences"},"nullable":true,"description":"Describes various evidence artifacts associated with the compliance finding."},"finding_info":{"$ref":"#/components/schemas/ocsfv1.8.0FindingInfo","description":"Describes the supporting information about a generated finding."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"remediation":{"$ref":"#/components/schemas/ocsfv1.8.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"resource":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails","nullable":true,"description":"Describes details about the resource that is the subject of the compliance check."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails"},"nullable":true,"description":"Describes details about the resource/resources that are the subject of the compliance check."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancefindingSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the least recent event included in the finding."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the least recent event included in the finding."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancefindingStatusId","nullable":true,"description":"The normalized status identifier of the Finding, set by the consumer."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0compliancefindingTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"vendor_attributes":{"$ref":"#/components/schemas/ocsfv1.8.0VendorAttributes","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["activity_id","category_uid","class_uid","compliance","finding_info","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0compliancefindingConfidenceId":{"id":"components/schemas/ocsfv1.8.0compliancefindingConfidenceId","kind":"json-schema","title":"ocsfv1.8.0compliancefindingConfidenceId","data":{"title":"ocsfv1.8.0compliancefindingConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0compliancefindingSeverityId":{"id":"components/schemas/ocsfv1.8.0compliancefindingSeverityId","kind":"json-schema","title":"ocsfv1.8.0compliancefindingSeverityId","data":{"title":"ocsfv1.8.0compliancefindingSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0compliancefindingStatusId":{"id":"components/schemas/ocsfv1.8.0compliancefindingStatusId","kind":"json-schema","title":"ocsfv1.8.0compliancefindingStatusId","data":{"title":"ocsfv1.8.0compliancefindingStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - New: The Finding is new and yet to be reviewed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - InProgress: The Finding is under review."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Suppressed: The Finding was reviewed, determined to be benign or a false positive and is now suppressed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Resolved: The Finding was reviewed, remediated and is now considered resolved."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Archived: The Finding was archived."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Deleted: The Finding was deleted. For example, it might have been created in error."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0compliancefindingTypeUid":{"id":"components/schemas/ocsfv1.8.0compliancefindingTypeUid","kind":"json-schema","title":"ocsfv1.8.0compliancefindingTypeUid","data":{"title":"ocsfv1.8.0compliancefindingTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n200300 - Unknown\n200301 - Create: A finding was created.\n200302 - Update: A finding was updated.\n200303 - Close: A finding was closed.\n200399 - Other"}},"components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoActivityId":{"id":"components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoActivityId","kind":"json-schema","title":"ocsfv1.8.0complianceframeworkinventoryinfoActivityId","data":{"title":"ocsfv1.8.0complianceframeworkinventoryinfoActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Log: The discovered information is via a log."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Collect: The discovered information is via a collection process."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoCategoryUid":{"id":"components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoCategoryUid","kind":"json-schema","title":"ocsfv1.8.0complianceframeworkinventoryinfoCategoryUid","data":{"title":"ocsfv1.8.0complianceframeworkinventoryinfoCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects."}},"components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoClassUid":{"id":"components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoClassUid","kind":"json-schema","title":"ocsfv1.8.0complianceframeworkinventoryinfoClassUid","data":{"title":"ocsfv1.8.0complianceframeworkinventoryinfoClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n98905005 - ComplianceFrameworkInventoryInfo: Compliance Framework Inventory Info events report the compliance standards and regulatory frameworks an organization is tracking in a GRC platform, along with aggregate posture counts. For example, when listing the frameworks in scope in a compliance-automation tool."}},"components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoComplianceFrameworkInventoryInfo":{"id":"components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoComplianceFrameworkInventoryInfo","kind":"json-schema","title":"ocsfv1.8.0complianceframeworkinventoryinfoComplianceFrameworkInventoryInfo","data":{"title":"ocsfv1.8.0complianceframeworkinventoryinfoComplianceFrameworkInventoryInfo","type":"object","description":"Compliance Framework Inventory Info events report the compliance standards and regulatory frameworks an organization is tracking in a GRC platform, along with aggregate posture counts. For example, when listing the frameworks in scope in a compliance-automation tool.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"compliance_framework":{"$ref":"#/components/schemas/ocsfv1.8.0ComplianceFramework","description":"The compliance framework that was discovered."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time, or the time the framework inventory was collected."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time, or the time the framework inventory was collected."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","compliance_framework","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoSeverityId":{"id":"components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoSeverityId","kind":"json-schema","title":"ocsfv1.8.0complianceframeworkinventoryinfoSeverityId","data":{"title":"ocsfv1.8.0complianceframeworkinventoryinfoSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoStatusId":{"id":"components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoStatusId","kind":"json-schema","title":"ocsfv1.8.0complianceframeworkinventoryinfoStatusId","data":{"title":"ocsfv1.8.0complianceframeworkinventoryinfoStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoTypeUid":{"id":"components/schemas/ocsfv1.8.0complianceframeworkinventoryinfoTypeUid","kind":"json-schema","title":"ocsfv1.8.0complianceframeworkinventoryinfoTypeUid","data":{"title":"ocsfv1.8.0complianceframeworkinventoryinfoTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n9890500500 - Unknown\n9890500501 - Log: The discovered information is via a log.\n9890500502 - Collect: The discovered information is via a collection process.\n9890500599 - Other"}},"components/schemas/ocsfv1.8.0compliancetestinventoryinfoActivityId":{"id":"components/schemas/ocsfv1.8.0compliancetestinventoryinfoActivityId","kind":"json-schema","title":"ocsfv1.8.0compliancetestinventoryinfoActivityId","data":{"title":"ocsfv1.8.0compliancetestinventoryinfoActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Log: The discovered information is via a log."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Collect: The discovered information is via a collection process."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0compliancetestinventoryinfoCategoryUid":{"id":"components/schemas/ocsfv1.8.0compliancetestinventoryinfoCategoryUid","kind":"json-schema","title":"ocsfv1.8.0compliancetestinventoryinfoCategoryUid","data":{"title":"ocsfv1.8.0compliancetestinventoryinfoCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects."}},"components/schemas/ocsfv1.8.0compliancetestinventoryinfoClassUid":{"id":"components/schemas/ocsfv1.8.0compliancetestinventoryinfoClassUid","kind":"json-schema","title":"ocsfv1.8.0compliancetestinventoryinfoClassUid","data":{"title":"ocsfv1.8.0compliancetestinventoryinfoClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n98905007 - ComplianceTestInventoryInfo: Compliance Test Inventory Info events report the automated tests defined in a GRC platform, along with their current pass/fail status and the controls they validate. For example, when listing the tests in a compliance-automation tool."}},"components/schemas/ocsfv1.8.0compliancetestinventoryinfoComplianceTestInventoryInfo":{"id":"components/schemas/ocsfv1.8.0compliancetestinventoryinfoComplianceTestInventoryInfo","kind":"json-schema","title":"ocsfv1.8.0compliancetestinventoryinfoComplianceTestInventoryInfo","data":{"title":"ocsfv1.8.0compliancetestinventoryinfoComplianceTestInventoryInfo","type":"object","description":"Compliance Test Inventory Info events report the automated tests defined in a GRC platform, along with their current pass/fail status and the controls they validate. For example, when listing the tests in a compliance-automation tool.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancetestinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0compliancetestinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0compliancetestinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"compliance_test":{"$ref":"#/components/schemas/ocsfv1.8.0ComplianceTest","description":"The compliance test that was discovered."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancetestinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0compliancetestinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time, or the time the test inventory was collected."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time, or the time the test inventory was collected."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0compliancetestinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","compliance_test","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0compliancetestinventoryinfoSeverityId":{"id":"components/schemas/ocsfv1.8.0compliancetestinventoryinfoSeverityId","kind":"json-schema","title":"ocsfv1.8.0compliancetestinventoryinfoSeverityId","data":{"title":"ocsfv1.8.0compliancetestinventoryinfoSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0compliancetestinventoryinfoStatusId":{"id":"components/schemas/ocsfv1.8.0compliancetestinventoryinfoStatusId","kind":"json-schema","title":"ocsfv1.8.0compliancetestinventoryinfoStatusId","data":{"title":"ocsfv1.8.0compliancetestinventoryinfoStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0compliancetestinventoryinfoTypeUid":{"id":"components/schemas/ocsfv1.8.0compliancetestinventoryinfoTypeUid","kind":"json-schema","title":"ocsfv1.8.0compliancetestinventoryinfoTypeUid","data":{"title":"ocsfv1.8.0compliancetestinventoryinfoTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n9890500700 - Unknown\n9890500701 - Log: The discovered information is via a log.\n9890500702 - Collect: The discovered information is via a collection process.\n9890500799 - Other"}},"components/schemas/ocsfv1.8.0conversationactivityActivityId":{"id":"components/schemas/ocsfv1.8.0conversationactivityActivityId","kind":"json-schema","title":"ocsfv1.8.0conversationactivityActivityId","data":{"title":"ocsfv1.8.0conversationactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - List: A list of conversations was retrieved."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Get: Details for a specific conversation were retrieved."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0conversationactivityCategoryUid":{"id":"components/schemas/ocsfv1.8.0conversationactivityCategoryUid","kind":"json-schema","title":"ocsfv1.8.0conversationactivityCategoryUid","data":{"title":"ocsfv1.8.0conversationactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n6 - ApplicationActivity: Application Activity events report detailed information about the behavior of applications and services."}},"components/schemas/ocsfv1.8.0conversationactivityClassUid":{"id":"components/schemas/ocsfv1.8.0conversationactivityClassUid","kind":"json-schema","title":"ocsfv1.8.0conversationactivityClassUid","data":{"title":"ocsfv1.8.0conversationactivityClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n98906003 - ConversationActivity: Conversation Activity events report information about conversations in enterprise chat platforms, such as Microsoft Teams channels, direct messages, or AI assistant sessions."}},"components/schemas/ocsfv1.8.0conversationactivityConversationActivity":{"id":"components/schemas/ocsfv1.8.0conversationactivityConversationActivity","kind":"json-schema","title":"ocsfv1.8.0conversationactivityConversationActivity","data":{"title":"ocsfv1.8.0conversationactivityConversationActivity","type":"object","description":"Conversation Activity events report information about conversations in enterprise chat platforms, such as Microsoft Teams channels, direct messages, or AI assistant sessions.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0conversationactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Application Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0conversationactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0conversationactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"conversation":{"$ref":"#/components/schemas/ocsfv1.8.0Conversation","description":"The details of the conversation."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0conversationactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0conversationactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0conversationactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","conversation","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0conversationactivitySeverityId":{"id":"components/schemas/ocsfv1.8.0conversationactivitySeverityId","kind":"json-schema","title":"ocsfv1.8.0conversationactivitySeverityId","data":{"title":"ocsfv1.8.0conversationactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0conversationactivityStatusId":{"id":"components/schemas/ocsfv1.8.0conversationactivityStatusId","kind":"json-schema","title":"ocsfv1.8.0conversationactivityStatusId","data":{"title":"ocsfv1.8.0conversationactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0conversationactivityTypeUid":{"id":"components/schemas/ocsfv1.8.0conversationactivityTypeUid","kind":"json-schema","title":"ocsfv1.8.0conversationactivityTypeUid","data":{"title":"ocsfv1.8.0conversationactivityTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n9890600300 - Unknown\n9890600301 - List: A list of conversations was retrieved.\n9890600302 - Get: Details for a specific conversation were retrieved.\n9890600399 - Other"}},"components/schemas/ocsfv1.8.0detectionfindingActionId":{"id":"components/schemas/ocsfv1.8.0detectionfindingActionId","kind":"json-schema","title":"ocsfv1.8.0detectionfindingActionId","data":{"title":"ocsfv1.8.0detectionfindingActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Observed: The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Modified: The activity was modified, adjusted, or corrected. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0detectionfindingActivityId":{"id":"components/schemas/ocsfv1.8.0detectionfindingActivityId","kind":"json-schema","title":"ocsfv1.8.0detectionfindingActivityId","data":{"title":"ocsfv1.8.0detectionfindingActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Create: A finding was created."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Update: A finding was updated."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Close: A finding was closed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0detectionfindingCategoryUid":{"id":"components/schemas/ocsfv1.8.0detectionfindingCategoryUid","kind":"json-schema","title":"ocsfv1.8.0detectionfindingCategoryUid","data":{"title":"ocsfv1.8.0detectionfindingCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n2 - Findings: Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products."}},"components/schemas/ocsfv1.8.0detectionfindingClassUid":{"id":"components/schemas/ocsfv1.8.0detectionfindingClassUid","kind":"json-schema","title":"ocsfv1.8.0detectionfindingClassUid","data":{"title":"ocsfv1.8.0detectionfindingClassUid","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ClassUid is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2004 - DetectionFinding: A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the event producer is a security control, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile should be applied and its "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"attacks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" information, if present, should be duplicated into the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note: "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the Finding is an incident, i.e. requires incident workflow, also apply the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"incident"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile  or aggregate this finding into an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Incident Finding"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0detectionfindingConfidenceId":{"id":"components/schemas/ocsfv1.8.0detectionfindingConfidenceId","kind":"json-schema","title":"ocsfv1.8.0detectionfindingConfidenceId","data":{"title":"ocsfv1.8.0detectionfindingConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0detectionfindingDetectionFinding":{"id":"components/schemas/ocsfv1.8.0detectionfindingDetectionFinding","kind":"json-schema","title":"ocsfv1.8.0detectionfindingDetectionFinding","data":{"title":"ocsfv1.8.0detectionfindingDetectionFinding","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the event producer is a security control, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile should be applied and its "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"attacks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" information, if present, should be duplicated into the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note: "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the Finding is an incident, i.e. requires incident workflow, also apply the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"incident"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile  or aggregate this finding into an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Incident Finding"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingActivityId","description":"The normalized identifier of the finding activity."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The finding activity name, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"anomaly_analyses":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0AnomalyAnalysis"},"nullable":true,"description":"Describes baseline information about normal activity patterns, along with any detected deviations or anomalies that triggered this finding."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"comment":{"type":"string","nullable":true,"description":"A user provided comment about the finding."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"device":{"$ref":"#/components/schemas/ocsfv1.8.0Device","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the affected device/host. If applicable, it can be used in conjunction with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Resource(s)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. Specific details about an AWS EC2 instance, that is affected by the Finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the most recent event included in the finding."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the most recent event included in the finding."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"evidences":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Evidences"},"nullable":true,"description":"Describes various evidence artifacts associated to the activity/activities that triggered a security detection."},"finding_info":{"$ref":"#/components/schemas/ocsfv1.8.0FindingInfo","description":"Describes the supporting information about a generated finding."},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"impact":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"impact_id":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingImpactId","nullable":true,"description":"The normalized impact of the incident or finding. Per NIST, this is the magnitude of harm that can be expected to result from the consequences of unauthorized disclosure, modification, destruction, or loss of information or information system availability."},"impact_score":{"type":"integer","nullable":true,"description":"The impact as an integer value of the finding, valid range 0-100."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. For example, an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of 'Create' could constitute an alertable signal and the value would be "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", while 'Close' likely would not and either omit the attribute or set its value to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":".  Note that other events with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile may also be deemed alertable signals and may also carry "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"is_alert = true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attributes."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"Describes malware reported in a Detection Finding."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about malware scan job that triggered this Detection Finding."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"remediation":{"$ref":"#/components/schemas/ocsfv1.8.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails"},"nullable":true,"description":"Describes details about resources that were the target of the activity that triggered the finding."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the least recent event included in the finding."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the least recent event included in the finding."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingStatusId","nullable":true,"description":"The normalized status identifier of the Finding, set by the consumer."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0detectionfindingTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"vendor_attributes":{"$ref":"#/components/schemas/ocsfv1.8.0VendorAttributes","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability."},"children":[],"type":"text"}],"type":"paragraph"}]},"vulnerabilities":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Vulnerability"},"nullable":true,"description":"Describes vulnerabilities reported in a Detection Finding."}},"required":["activity_id","category_uid","class_uid","finding_info","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0detectionfindingDispositionId":{"id":"components/schemas/ocsfv1.8.0detectionfindingDispositionId","kind":"json-schema","title":"ocsfv1.8.0detectionfindingDispositionId","data":{"title":"ocsfv1.8.0detectionfindingDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0detectionfindingImpactId":{"id":"components/schemas/ocsfv1.8.0detectionfindingImpactId","kind":"json-schema","title":"ocsfv1.8.0detectionfindingImpactId","data":{"title":"ocsfv1.8.0detectionfindingImpactId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ImpactId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized impact is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low: The magnitude of harm is low."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium: The magnitude of harm is moderate."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High: The magnitude of harm is high."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical: The magnitude of harm is high and the scope is widespread."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The impact is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"impact"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0detectionfindingRiskLevelId":{"id":"components/schemas/ocsfv1.8.0detectionfindingRiskLevelId","kind":"json-schema","title":"ocsfv1.8.0detectionfindingRiskLevelId","data":{"title":"ocsfv1.8.0detectionfindingRiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0detectionfindingSeverityId":{"id":"components/schemas/ocsfv1.8.0detectionfindingSeverityId","kind":"json-schema","title":"ocsfv1.8.0detectionfindingSeverityId","data":{"title":"ocsfv1.8.0detectionfindingSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0detectionfindingStatusId":{"id":"components/schemas/ocsfv1.8.0detectionfindingStatusId","kind":"json-schema","title":"ocsfv1.8.0detectionfindingStatusId","data":{"title":"ocsfv1.8.0detectionfindingStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - New: The Finding is new and yet to be reviewed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - InProgress: The Finding is under review."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Suppressed: The Finding was reviewed, determined to be benign or a false positive and is now suppressed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Resolved: The Finding was reviewed, remediated and is now considered resolved."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Archived: The Finding was archived."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Deleted: The Finding was deleted. For example, it might have been created in error."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0detectionfindingTypeUid":{"id":"components/schemas/ocsfv1.8.0detectionfindingTypeUid","kind":"json-schema","title":"ocsfv1.8.0detectionfindingTypeUid","data":{"title":"ocsfv1.8.0detectionfindingTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n200400 - Unknown\n200401 - Create: A finding was created.\n200402 - Update: A finding was updated.\n200403 - Close: A finding was closed.\n200499 - Other"}},"components/schemas/ocsfv1.8.0dnsactivityActionId":{"id":"components/schemas/ocsfv1.8.0dnsactivityActionId","kind":"json-schema","title":"ocsfv1.8.0dnsactivityActionId","data":{"title":"ocsfv1.8.0dnsactivityActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Observed: The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Modified: The activity was modified, adjusted, or corrected. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0dnsactivityActivityId":{"id":"components/schemas/ocsfv1.8.0dnsactivityActivityId","kind":"json-schema","title":"ocsfv1.8.0dnsactivityActivityId","data":{"title":"ocsfv1.8.0dnsactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Query: The DNS query request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Response: The DNS query response."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Traffic: Bidirectional DNS request and response traffic."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0dnsactivityCategoryUid":{"id":"components/schemas/ocsfv1.8.0dnsactivityCategoryUid","kind":"json-schema","title":"ocsfv1.8.0dnsactivityCategoryUid","data":{"title":"ocsfv1.8.0dnsactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n4 - NetworkActivity: Network Activity events."}},"components/schemas/ocsfv1.8.0dnsactivityClassUid":{"id":"components/schemas/ocsfv1.8.0dnsactivityClassUid","kind":"json-schema","title":"ocsfv1.8.0dnsactivityClassUid","data":{"title":"ocsfv1.8.0dnsactivityClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n4003 - DNSActivity: DNS Activity events report DNS queries and answers as seen on the network."}},"components/schemas/ocsfv1.8.0dnsactivityConfidenceId":{"id":"components/schemas/ocsfv1.8.0dnsactivityConfidenceId","kind":"json-schema","title":"ocsfv1.8.0dnsactivityConfidenceId","data":{"title":"ocsfv1.8.0dnsactivityConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0dnsactivityDispositionId":{"id":"components/schemas/ocsfv1.8.0dnsactivityDispositionId","kind":"json-schema","title":"ocsfv1.8.0dnsactivityDispositionId","data":{"title":"ocsfv1.8.0dnsactivityDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0dnsactivityDnsActivity":{"id":"components/schemas/ocsfv1.8.0dnsactivityDnsActivity","kind":"json-schema","title":"ocsfv1.8.0dnsactivityDnsActivity","data":{"title":"ocsfv1.8.0dnsactivityDnsActivity","type":"object","description":"DNS Activity events report DNS queries and answers as seen on the network.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"answers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0DnsAnswer"},"nullable":true,"description":"The Domain Name System (DNS) answers."},"app_name":{"type":"string","nullable":true,"description":"The network application name identified by tools such as NBAR or App ID (e.g., youtube, facebook, webex). This represents a specific network application that uses standard protocols (such as https or quic) to deliver its service."},"app_protocol_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The application-layer (Layer 7) protocol name identified by deep packet inspection or packet parsing (e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"quic"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ssh"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dns"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"), expressed as an IANA-registered service name from the IANA Service Name and Transport Protocol Port Number Registry."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" Port numbers alone are not always a reliable indicator of the actual application protocol in use."},"children":[],"type":"text"}],"type":"tag","tag":"html"}]},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Network Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"connection_info":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkConnectionInfo","nullable":true,"description":"The network connection information."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"cumulative_traffic":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkTraffic","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cumulative (running total) network traffic aggregated from the start of a flow or session. Use when reporting: (1) total accumulated bytes/packets since flow initiation, (2) combined aggregation models where both incremental deltas and running totals are reported together (populate both "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"traffic"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the delta and this attribute for the cumulative total), or (3) final summary metrics when a long-lived connection closes. This represents the sum of all activity from flow start to the current observation, not a delta or point-in-time value."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint","nullable":true,"description":"The responder (server) in a network connection."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"ja4_fingerprint_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Ja4Fingerprint"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of the JA4+ network fingerprints."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"network_observation_point":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network endpoint that observes or inspects network traffic as a third-party system, used when the observer is neither the source nor the destination of the communication (when "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"observation_point_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" = 3). Examples include network taps, span ports, inline security devices, or packet capture systems that monitor traffic between other endpoints."},"children":[],"type":"text"}],"type":"paragraph"}]},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"observation_point":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity. The value is normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"observation_point_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"observation_point_id":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityObservationPointId","nullable":true,"description":"The normalized identifier of the observation point. The observation point identifier indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity."},"packet_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Packet"},"nullable":true,"description":"The list of packet objects describing captured network packets."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"proxy":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkProxy","nullable":true,"description":"The proxy (server) in a network connection."},"query":{"$ref":"#/components/schemas/ocsfv1.8.0DnsQuery","nullable":true,"description":"The Domain Name System (DNS) query."},"query_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The Domain Name System (DNS) query time."},"query_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The Domain Name System (DNS) query time."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"rcode":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The DNS server response code, normalized to the caption of the rcode_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"rcode_id":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityRcodeId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized identifier of the DNS server response code. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc6895"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-6895"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"response_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The Domain Name System (DNS) response time."},"response_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The Domain Name System (DNS) response time."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint","nullable":true,"description":"The initiator (client) of the network connection."},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"tls":{"$ref":"#/components/schemas/ocsfv1.8.0Tls","nullable":true,"description":"The Transport Layer Security (TLS) attributes."},"traffic":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkTraffic","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network traffic for this observation period. Use when reporting: (1) delta values (bytes/packets transferred since the last observation), (2) instantaneous measurements at a specific point in time, or (3) standalone single-event metrics. This attribute represents a point-in-time measurement or incremental change, not a running total. For accumulated totals across multiple observations or the lifetime of a flow, use "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cumulative_traffic"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" instead."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0dnsactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0dnsactivityObservationPointId":{"id":"components/schemas/ocsfv1.8.0dnsactivityObservationPointId","kind":"json-schema","title":"ocsfv1.8.0dnsactivityObservationPointId","data":{"title":"ocsfv1.8.0dnsactivityObservationPointId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ObservationPointId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The observation point is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Source: The source network endpoint is the observation point."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Destination: The destination network endpoint is the observation point."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Neither: Neither the source nor destination network endpoint is the observation point. Refer to the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"network_observation_point"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Both: Both the source and destination network endpoint are the observation point. This typically occurs in localhost or internal communications where the source and destination are the same endpoint, often resulting in a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"connection_info.direction"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Local"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The observation point is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"observation_point"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0dnsactivityRcodeId":{"id":"components/schemas/ocsfv1.8.0dnsactivityRcodeId","kind":"json-schema","title":"ocsfv1.8.0dnsactivityRcodeId","data":{"title":"ocsfv1.8.0dnsactivityRcodeId","type":"integer","description":"RcodeId is an enum, and the following values are allowed.\n0 - NoError: No Error.\n1 - FormError: Format Error.\n2 - ServError: Server Failure.\n3 - NXDomain: Non-Existent Domain.\n4 - NotImp: Not Implemented.\n5 - Refused: Query Refused.\n6 - YXDomain: Name Exists when it should not.\n7 - YXRRSet: RR Set Exists when it should not.\n8 - NXRRSet: RR Set that should exist does not.\n9 - NotAuth: Not Authorized or Server Not Authoritative for zone.\n10 - NotZone: Name not contained in zone.\n11 - DSOTYPENI: DSO-TYPE Not Implemented.\n16 - VERS: TSIG Signature Failure or Bad OPT Version.\n17 - BADKEY: Key not recognized.\n18 - BADTIME: Signature out of time window.\n19 - BADMODE: Bad TKEY Mode.\n20 - BADNAME: Duplicate key name.\n21 - BADALG: Algorithm not supported.\n22 - BADTRUNC: Bad Truncation.\n23 - BADCOOKIE: Bad/missing Server Cookie.\n24 - Unassigned: The codes deemed to be unassigned by the RFC (unassigned codes: 12-15, 24-3840, 4096-65534).\n25 - Reserved: The codes deemed to be reserved by the RFC (codes: 3841-4095, 65535).\n99 - Other: The dns response code is not defined by the RFC."}},"components/schemas/ocsfv1.8.0dnsactivityRiskLevelId":{"id":"components/schemas/ocsfv1.8.0dnsactivityRiskLevelId","kind":"json-schema","title":"ocsfv1.8.0dnsactivityRiskLevelId","data":{"title":"ocsfv1.8.0dnsactivityRiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0dnsactivitySeverityId":{"id":"components/schemas/ocsfv1.8.0dnsactivitySeverityId","kind":"json-schema","title":"ocsfv1.8.0dnsactivitySeverityId","data":{"title":"ocsfv1.8.0dnsactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0dnsactivityStatusId":{"id":"components/schemas/ocsfv1.8.0dnsactivityStatusId","kind":"json-schema","title":"ocsfv1.8.0dnsactivityStatusId","data":{"title":"ocsfv1.8.0dnsactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0dnsactivityTypeUid":{"id":"components/schemas/ocsfv1.8.0dnsactivityTypeUid","kind":"json-schema","title":"ocsfv1.8.0dnsactivityTypeUid","data":{"title":"ocsfv1.8.0dnsactivityTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n400300 - Unknown\n400301 - Query: The DNS query request.\n400302 - Response: The DNS query response.\n400306 - Traffic: Bidirectional DNS request and response traffic.\n400399 - Other"}},"components/schemas/ocsfv1.8.0emailactivityActionId":{"id":"components/schemas/ocsfv1.8.0emailactivityActionId","kind":"json-schema","title":"ocsfv1.8.0emailactivityActionId","data":{"title":"ocsfv1.8.0emailactivityActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Observed: The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Modified: The activity was modified, adjusted, or corrected. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0emailactivityActivityId":{"id":"components/schemas/ocsfv1.8.0emailactivityActivityId","kind":"json-schema","title":"ocsfv1.8.0emailactivityActivityId","data":{"title":"ocsfv1.8.0emailactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Send"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Receive"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Scan: Email being scanned (example: security scanning)"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Trace: Follow an email message as it travels through an organization. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message_trace_uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" should be populated when selected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - MTARelay: Email processed by an MTA, typically combining send, receive, and scan operations into a single activity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0emailactivityCategoryUid":{"id":"components/schemas/ocsfv1.8.0emailactivityCategoryUid","kind":"json-schema","title":"ocsfv1.8.0emailactivityCategoryUid","data":{"title":"ocsfv1.8.0emailactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n4 - NetworkActivity: Network Activity events."}},"components/schemas/ocsfv1.8.0emailactivityClassUid":{"id":"components/schemas/ocsfv1.8.0emailactivityClassUid","kind":"json-schema","title":"ocsfv1.8.0emailactivityClassUid","data":{"title":"ocsfv1.8.0emailactivityClassUid","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ClassUid is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4009 - EmailActivity: Email Activity events report SMTP protocol and email activities including those with embedded URLs and files. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Email"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object for details."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0emailactivityConfidenceId":{"id":"components/schemas/ocsfv1.8.0emailactivityConfidenceId","kind":"json-schema","title":"ocsfv1.8.0emailactivityConfidenceId","data":{"title":"ocsfv1.8.0emailactivityConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0emailactivityDirectionId":{"id":"components/schemas/ocsfv1.8.0emailactivityDirectionId","kind":"json-schema","title":"ocsfv1.8.0emailactivityDirectionId","data":{"title":"ocsfv1.8.0emailactivityDirectionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DirectionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The email direction is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Inbound: Email Inbound, from the Internet or outside network destined for an entity inside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Outbound: Email Outbound, from inside the network destined for an entity outside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Internal: Email Internal, from inside the network destined for an entity inside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Local: Local network connection ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"localhost"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"). The connection is intra-device, originating from and destined for services running on the same device."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The direction is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"direction"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0emailactivityDispositionId":{"id":"components/schemas/ocsfv1.8.0emailactivityDispositionId","kind":"json-schema","title":"ocsfv1.8.0emailactivityDispositionId","data":{"title":"ocsfv1.8.0emailactivityDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0emailactivityEmailActivity":{"id":"components/schemas/ocsfv1.8.0emailactivityEmailActivity","kind":"json-schema","title":"ocsfv1.8.0emailactivityEmailActivity","data":{"title":"ocsfv1.8.0emailactivityEmailActivity","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Email Activity events report SMTP protocol and email activities including those with embedded URLs and files. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Email"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object for details."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.8.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"attempt":{"type":"integer","nullable":true,"description":"The attempt number for attempting to deliver the email."},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"banner":{"type":"string","nullable":true,"description":"The initial connection response that a messaging server receives after it connects to an email server."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Network Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"command":{"type":"string","nullable":true,"description":"The command issued by the initiator (client), such as SMTP HELO or EHLO."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"device":{"$ref":"#/components/schemas/ocsfv1.8.0Device","nullable":true,"description":"An addressable device, computer system or host."},"direction":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The direction of the email, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"direction_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value."},"children":[],"type":"text"}],"type":"paragraph"}]},"direction_id":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityDirectionId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The direction of the email relative to the scanning host or organization."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"Email scanned at an internet gateway might be characterized as inbound to the organization from the Internet, outbound from the organization to the Internet, or internal within the organization. Email scanned at a workstation might be characterized as inbound to, or outbound from the workstation."},"children":[],"type":"text"}]},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint","nullable":true,"description":"The responder (server) receiving the email."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"email":{"$ref":"#/components/schemas/ocsfv1.8.0Email","description":"The email object."},"email_auth":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAuth","nullable":true,"description":"The SPF, DKIM and DMARC attributes of an email."},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"from":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress","nullable":true,"description":"The sender address from the transmission envelope. This reflects the actual sending party and may differ from the 'From' header in the message."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"message_trace_uid":{"type":"string","nullable":true,"description":"The identifier that tracks a message that travels through multiple points of a messaging service."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"protocol_name":{"type":"string","nullable":true,"description":"The Protocol Name specifies the email communication protocol, such as SMTP, IMAP, or POP3."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"smtp_hello":{"type":"string","nullable":true,"description":"The value of the SMTP HELO or EHLO command sent by the initiator (client)."},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint","nullable":true,"description":"The initiator (client) sending the email."},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"to":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress"},"nullable":true,"description":"The recipient address from the transmission envelope. This may differ from the 'To' header and represents where the message was actually delivered."},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0emailactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","direction_id","email","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0emailactivityRiskLevelId":{"id":"components/schemas/ocsfv1.8.0emailactivityRiskLevelId","kind":"json-schema","title":"ocsfv1.8.0emailactivityRiskLevelId","data":{"title":"ocsfv1.8.0emailactivityRiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0emailactivitySeverityId":{"id":"components/schemas/ocsfv1.8.0emailactivitySeverityId","kind":"json-schema","title":"ocsfv1.8.0emailactivitySeverityId","data":{"title":"ocsfv1.8.0emailactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0emailactivityStatusId":{"id":"components/schemas/ocsfv1.8.0emailactivityStatusId","kind":"json-schema","title":"ocsfv1.8.0emailactivityStatusId","data":{"title":"ocsfv1.8.0emailactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0emailactivityTypeUid":{"id":"components/schemas/ocsfv1.8.0emailactivityTypeUid","kind":"json-schema","title":"ocsfv1.8.0emailactivityTypeUid","data":{"title":"ocsfv1.8.0emailactivityTypeUid","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TypeUid is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400900 - Unknown"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400901 - Send"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400902 - Receive"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400903 - Scan: Email being scanned (example: security scanning)"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400904 - Trace: Follow an email message as it travels through an organization. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message_trace_uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" should be populated when selected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400905 - MTARelay: Email processed by an MTA, typically combining send, receive, and scan operations into a single activity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400999 - Other"},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0networkactivityActionId":{"id":"components/schemas/ocsfv1.8.0networkactivityActionId","kind":"json-schema","title":"ocsfv1.8.0networkactivityActionId","data":{"title":"ocsfv1.8.0networkactivityActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Observed: The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Modified: The activity was modified, adjusted, or corrected. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0networkactivityActivityId":{"id":"components/schemas/ocsfv1.8.0networkactivityActivityId","kind":"json-schema","title":"ocsfv1.8.0networkactivityActivityId","data":{"title":"ocsfv1.8.0networkactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Open: A new network connection was opened."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Close: The network connection was closed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Reset: The network connection was abnormally terminated or closed by a middle device like firewalls."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Fail: The network connection failed. For example a connection timeout or no route to host."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Refuse: The network connection was refused. For example an attempt to connect to a server port which is not open."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Traffic: Network traffic report."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Listen: A network endpoint began listening for new network connections."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0networkactivityCategoryUid":{"id":"components/schemas/ocsfv1.8.0networkactivityCategoryUid","kind":"json-schema","title":"ocsfv1.8.0networkactivityCategoryUid","data":{"title":"ocsfv1.8.0networkactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n4 - NetworkActivity: Network Activity events."}},"components/schemas/ocsfv1.8.0networkactivityClassUid":{"id":"components/schemas/ocsfv1.8.0networkactivityClassUid","kind":"json-schema","title":"ocsfv1.8.0networkactivityClassUid","data":{"title":"ocsfv1.8.0networkactivityClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n4001 - NetworkActivity: Network Activity events report network connection and traffic activity."}},"components/schemas/ocsfv1.8.0networkactivityConfidenceId":{"id":"components/schemas/ocsfv1.8.0networkactivityConfidenceId","kind":"json-schema","title":"ocsfv1.8.0networkactivityConfidenceId","data":{"title":"ocsfv1.8.0networkactivityConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0networkactivityDispositionId":{"id":"components/schemas/ocsfv1.8.0networkactivityDispositionId","kind":"json-schema","title":"ocsfv1.8.0networkactivityDispositionId","data":{"title":"ocsfv1.8.0networkactivityDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0networkactivityNetworkActivity":{"id":"components/schemas/ocsfv1.8.0networkactivityNetworkActivity","kind":"json-schema","title":"ocsfv1.8.0networkactivityNetworkActivity","data":{"title":"ocsfv1.8.0networkactivityNetworkActivity","type":"object","description":"Network Activity events report network connection and traffic activity.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"app_name":{"type":"string","nullable":true,"description":"The network application name identified by tools such as NBAR or App ID (e.g., youtube, facebook, webex). This represents a specific network application that uses standard protocols (such as https or quic) to deliver its service."},"app_protocol_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The application-layer (Layer 7) protocol name identified by deep packet inspection or packet parsing (e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"quic"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ssh"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dns"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"), expressed as an IANA-registered service name from the IANA Service Name and Transport Protocol Port Number Registry."},"children":[],"type":"text"}],"type":"paragraph"},{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" Port numbers alone are not always a reliable indicator of the actual application protocol in use."},"children":[],"type":"text"}],"type":"tag","tag":"html"}]},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Network Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"connection_info":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkConnectionInfo","nullable":true,"description":"The network connection information."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"cumulative_traffic":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkTraffic","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cumulative (running total) network traffic aggregated from the start of a flow or session. Use when reporting: (1) total accumulated bytes/packets since flow initiation, (2) combined aggregation models where both incremental deltas and running totals are reported together (populate both "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"traffic"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the delta and this attribute for the cumulative total), or (3) final summary metrics when a long-lived connection closes. This represents the sum of all activity from flow start to the current observation, not a delta or point-in-time value."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The responder of the network connection. In some contexts an event source cannot correctly identify the responder. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"is_src_dst_assignment_known"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for certainty."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"is_src_dst_assignment_known":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" denotes that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"src_endpoint"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dst_endpoint"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" correctly identify the initiator and responder respectively. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" denotes that the event source has arbitrarily assigned one peer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"src_endpoint"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and the other to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dst_endpoint"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", in other words that initiator and responder are not being asserted. This can occur, for example, when the event source is a network appliance that has not observed the initiation of a given connection. In the absence of this attribute, interpretation of the initiator and responder is implementation-specific."},"children":[],"type":"text"}],"type":"paragraph"}]},"ja4_fingerprint_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Ja4Fingerprint"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of the JA4+ network fingerprints."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"network_observation_point":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network endpoint that observes or inspects network traffic as a third-party system, used when the observer is neither the source nor the destination of the communication (when "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"observation_point_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" = 3). Examples include network taps, span ports, inline security devices, or packet capture systems that monitor traffic between other endpoints."},"children":[],"type":"text"}],"type":"paragraph"}]},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"observation_point":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity. The value is normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"observation_point_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"observation_point_id":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityObservationPointId","nullable":true,"description":"The normalized identifier of the observation point. The observation point identifier indicates whether the source network endpoint, destination network endpoint, or neither served as the observation point for the activity."},"packet_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Packet"},"nullable":true,"description":"The list of packet objects describing captured network packets."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"proxy":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkProxy","nullable":true,"description":"The proxy (server) in a network connection."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The initiator of the network connection. In some contexts an event source cannot correctly identify the initiator. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"is_src_dst_assignment_known"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for certainty."},"children":[],"type":"text"}],"type":"paragraph"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"tls":{"$ref":"#/components/schemas/ocsfv1.8.0Tls","nullable":true,"description":"The Transport Layer Security (TLS) attributes."},"traffic":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkTraffic","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network traffic for this observation period. Use when reporting: (1) delta values (bytes/packets transferred since the last observation), (2) instantaneous measurements at a specific point in time, or (3) standalone single-event metrics. This attribute represents a point-in-time measurement or incremental change, not a running total. For accumulated totals across multiple observations or the lifetime of a flow, use "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cumulative_traffic"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" instead."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0networkactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"url":{"$ref":"#/components/schemas/ocsfv1.8.0Url","nullable":true,"description":"The URL details relevant to the network traffic."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0networkactivityObservationPointId":{"id":"components/schemas/ocsfv1.8.0networkactivityObservationPointId","kind":"json-schema","title":"ocsfv1.8.0networkactivityObservationPointId","data":{"title":"ocsfv1.8.0networkactivityObservationPointId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ObservationPointId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The observation point is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Source: The source network endpoint is the observation point."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Destination: The destination network endpoint is the observation point."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Neither: Neither the source nor destination network endpoint is the observation point. Refer to the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"network_observation_point"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Both: Both the source and destination network endpoint are the observation point. This typically occurs in localhost or internal communications where the source and destination are the same endpoint, often resulting in a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"connection_info.direction"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Local"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The observation point is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"observation_point"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0networkactivityRiskLevelId":{"id":"components/schemas/ocsfv1.8.0networkactivityRiskLevelId","kind":"json-schema","title":"ocsfv1.8.0networkactivityRiskLevelId","data":{"title":"ocsfv1.8.0networkactivityRiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0networkactivitySeverityId":{"id":"components/schemas/ocsfv1.8.0networkactivitySeverityId","kind":"json-schema","title":"ocsfv1.8.0networkactivitySeverityId","data":{"title":"ocsfv1.8.0networkactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0networkactivityStatusId":{"id":"components/schemas/ocsfv1.8.0networkactivityStatusId","kind":"json-schema","title":"ocsfv1.8.0networkactivityStatusId","data":{"title":"ocsfv1.8.0networkactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0networkactivityTypeUid":{"id":"components/schemas/ocsfv1.8.0networkactivityTypeUid","kind":"json-schema","title":"ocsfv1.8.0networkactivityTypeUid","data":{"title":"ocsfv1.8.0networkactivityTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n400100 - Unknown\n400101 - Open: A new network connection was opened.\n400102 - Close: The network connection was closed.\n400103 - Reset: The network connection was abnormally terminated or closed by a middle device like firewalls.\n400104 - Fail: The network connection failed. For example a connection timeout or no route to host.\n400105 - Refuse: The network connection was refused. For example an attempt to connect to a server port which is not open.\n400106 - Traffic: Network traffic report.\n400107 - Listen: A network endpoint began listening for new network connections.\n400199 - Other"}},"components/schemas/ocsfv1.8.0noteactivityActionId":{"id":"components/schemas/ocsfv1.8.0noteactivityActionId","kind":"json-schema","title":"ocsfv1.8.0noteactivityActionId","data":{"title":"ocsfv1.8.0noteactivityActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Observed: The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Modified: The activity was modified, adjusted, or corrected. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0noteactivityActivityId":{"id":"components/schemas/ocsfv1.8.0noteactivityActivityId","kind":"json-schema","title":"ocsfv1.8.0noteactivityActivityId","data":{"title":"ocsfv1.8.0noteactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Create: A finding was created."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Update: A finding was updated."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Close: A finding was closed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0noteactivityCategoryUid":{"id":"components/schemas/ocsfv1.8.0noteactivityCategoryUid","kind":"json-schema","title":"ocsfv1.8.0noteactivityCategoryUid","data":{"title":"ocsfv1.8.0noteactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n2 - Findings: Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products."}},"components/schemas/ocsfv1.8.0noteactivityClassUid":{"id":"components/schemas/ocsfv1.8.0noteactivityClassUid","kind":"json-schema","title":"ocsfv1.8.0noteactivityClassUid","data":{"title":"ocsfv1.8.0noteactivityClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n98902001 - NoteActivity: Note Activity events report notes created on threats."}},"components/schemas/ocsfv1.8.0noteactivityConfidenceId":{"id":"components/schemas/ocsfv1.8.0noteactivityConfidenceId","kind":"json-schema","title":"ocsfv1.8.0noteactivityConfidenceId","data":{"title":"ocsfv1.8.0noteactivityConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0noteactivityDispositionId":{"id":"components/schemas/ocsfv1.8.0noteactivityDispositionId","kind":"json-schema","title":"ocsfv1.8.0noteactivityDispositionId","data":{"title":"ocsfv1.8.0noteactivityDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0noteactivityNoteActivity":{"id":"components/schemas/ocsfv1.8.0noteactivityNoteActivity","kind":"json-schema","title":"ocsfv1.8.0noteactivityNoteActivity","data":{"title":"ocsfv1.8.0noteactivityNoteActivity","type":"object","description":"Note Activity events report notes created on threats.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0noteactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0noteactivityActivityId","description":"The normalized identifier of the finding activity."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The finding activity name, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0noteactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0noteactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"comment":{"type":"string","nullable":true,"description":"A user provided comment about the finding."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0noteactivityConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"device":{"$ref":"#/components/schemas/ocsfv1.8.0Device","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the affected device/host. If applicable, it can be used in conjunction with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Resource(s)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. Specific details about an AWS EC2 instance, that is affected by the Finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0noteactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the most recent event included in the finding."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the most recent event included in the finding."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"finding_info":{"$ref":"#/components/schemas/ocsfv1.8.0FindingInfo","description":"Describes the supporting information about a generated finding."},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"note":{"$ref":"#/components/schemas/ocsfv1.8.0Annotation","description":"The annotation that describes the note created on a related object."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0noteactivityRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0noteactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the least recent event included in the finding."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the least recent event included in the finding."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0noteactivityStatusId","nullable":true,"description":"The normalized status identifier of the Finding, set by the consumer."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0noteactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"vendor_attributes":{"$ref":"#/components/schemas/ocsfv1.8.0VendorAttributes","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["activity_id","category_uid","class_uid","finding_info","metadata","note","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0noteactivityRiskLevelId":{"id":"components/schemas/ocsfv1.8.0noteactivityRiskLevelId","kind":"json-schema","title":"ocsfv1.8.0noteactivityRiskLevelId","data":{"title":"ocsfv1.8.0noteactivityRiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0noteactivitySeverityId":{"id":"components/schemas/ocsfv1.8.0noteactivitySeverityId","kind":"json-schema","title":"ocsfv1.8.0noteactivitySeverityId","data":{"title":"ocsfv1.8.0noteactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0noteactivityStatusId":{"id":"components/schemas/ocsfv1.8.0noteactivityStatusId","kind":"json-schema","title":"ocsfv1.8.0noteactivityStatusId","data":{"title":"ocsfv1.8.0noteactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - New: The Finding is new and yet to be reviewed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - InProgress: The Finding is under review."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Suppressed: The Finding was reviewed, determined to be benign or a false positive and is now suppressed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Resolved: The Finding was reviewed, remediated and is now considered resolved."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Archived: The Finding was archived."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Deleted: The Finding was deleted. For example, it might have been created in error."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0noteactivityTypeUid":{"id":"components/schemas/ocsfv1.8.0noteactivityTypeUid","kind":"json-schema","title":"ocsfv1.8.0noteactivityTypeUid","data":{"title":"ocsfv1.8.0noteactivityTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n9890200100 - Unknown\n9890200101 - Create: A finding was created.\n9890200102 - Update: A finding was updated.\n9890200103 - Close: A finding was closed.\n9890200199 - Other"}},"components/schemas/ocsfv1.8.0AccessGrant":{"id":"components/schemas/ocsfv1.8.0AccessGrant","kind":"json-schema","title":"ocsfv1.8.0AccessGrant","data":{"title":"ocsfv1.8.0AccessGrant","type":"object","description":"The Access Grant object describes standing access that a principal holds, or that an entity requests: permissions or scopes granted to an application, or a user, group or application assigned to an application or resource. A requested grant, such as a permission an application asks for, has no identifier or name of its own.","properties":{"consent_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The consent type, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"consent_type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"consent_type_id":{"$ref":"#/components/schemas/ocsfv1.8.0AccessGrant_ConsentTypeId","nullable":true,"description":"The normalized identifier of how the grant was consented to."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the grant was made."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the grant was made."},"expiration_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the grant expires."},"expiration_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the grant expires."},"iam_role":{"$ref":"#/components/schemas/ocsfv1.8.0IamRole","nullable":true,"description":"The role the grant gives. For example, an application role."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the grant was last modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the grant was last modified."},"name":{"type":"string","nullable":true,"description":"The name of the grant."},"privileges":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The permissions or scopes the grant gives. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User.Read.All"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"openid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails"},"nullable":true,"description":"The resources the grant gives access to. For example, a cloud subscription or storage bucket."},"state":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The grant state, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"state_id":{"$ref":"#/components/schemas/ocsfv1.8.0AccessGrant_StateId","nullable":true,"description":"The normalized identifier of the grant state."},"target_application":{"$ref":"#/components/schemas/ocsfv1.8.0Application","nullable":true,"description":"The application that access is granted on: the application that exposes the granted permissions or role, such as an API, or the application a principal is assigned to."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The grant type, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0AccessGrant_TypeId","description":"The normalized identifier of the grant type."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the grant. For example, the OAuth consent grant ID."}},"required":["type_id"]}},"components/schemas/ocsfv1.8.0AccessGrant_ConsentTypeId":{"id":"components/schemas/ocsfv1.8.0AccessGrant_ConsentTypeId","kind":"json-schema","title":"ocsfv1.8.0AccessGrant_ConsentTypeId","data":{"title":"ocsfv1.8.0AccessGrant_ConsentTypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AccessGrantConsentTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The consent type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Admin: An administrator consented on behalf of the organization or tenant."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - User: A user consented for themselves."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - System: The platform granted the access without an administrator or user consenting. For example, a pre-authorized application."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The consent type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"consent_type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0AccessGrant_StateId":{"id":"components/schemas/ocsfv1.8.0AccessGrant_StateId","kind":"json-schema","title":"ocsfv1.8.0AccessGrant_StateId","data":{"title":"ocsfv1.8.0AccessGrant_StateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AccessGrantStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The grant state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Active: The grant is in effect."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Inactive: The grant exists but is not in effect. For example, a suspended assignment."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Revoked: The grant was revoked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Expired: The grant reached its expiration time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The grant state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0AccessGrant_TypeId":{"id":"components/schemas/ocsfv1.8.0AccessGrant_TypeId","kind":"json-schema","title":"ocsfv1.8.0AccessGrant_TypeId","data":{"title":"ocsfv1.8.0AccessGrant_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AccessGrantTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The grant type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - DelegatedPermission: Permissions or scopes granted to an application to act on behalf of a signed-in user. For example, an OAuth consent grant."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - ApplicationPermission: Permissions granted to an application to act as itself, without a signed-in user. For example, an application role on an API granted to a service principal."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Assignment: A principal assigned to an application or resource, optionally with a role, giving it access to that application or resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The grant type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Account":{"id":"components/schemas/ocsfv1.8.0Account","kind":"json-schema","title":"ocsfv1.8.0Account","data":{"title":"ocsfv1.8.0Account","type":"object","description":"The Account object contains details about the account that initiated or performed a specific activity within a system or application. Additionally, the Account object refers to logical Cloud and Software-as-a-Service (SaaS) based containers such as AWS Accounts, Azure Subscriptions, Oracle Cloud Compartments, Google Cloud Projects, and otherwise.","properties":{"is_disabled":{"type":"boolean","nullable":true,"description":"Indicates if the account is disabled."},"is_locked":{"type":"boolean","nullable":true,"description":"Indicates if the account is locked. For example, due to the amount of failed logins."},"is_on_premises_sync_enabled":{"type":"boolean","nullable":true,"description":"Indicates whether synchronization with an on-premises directory service is enabled. For example, Microsoft Entra Connect."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels associated to the account."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the account (e.g. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" GCP Project name "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Linux Account name "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" AWS Account name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}]},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the account."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Account_TypeId","nullable":true,"description":"The normalized account type identifier."},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the account (e.g. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" AWS Account ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" OCID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" GCP Project ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Azure Subscription ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Google Workspace Customer ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" M365 Tenant UID"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0Account_TypeId":{"id":"components/schemas/ocsfv1.8.0Account_TypeId","kind":"json-schema","title":"ocsfv1.8.0Account_TypeId","data":{"title":"ocsfv1.8.0Account_TypeId","type":"integer","description":"AccountTypeId is an enum, and the following values are allowed.\n0 - Unknown: The account type is unknown.\n1 - LDAPAccount\n2 - WindowsAccount\n3 - AWSIAMUser\n4 - AWSIAMRole\n5 - GCPAccount\n6 - AzureADAccount: Note: The new product name for Azure AD is Microsoft Entra ID.\n7 - MacOSAccount\n8 - AppleAccount\n9 - LinuxAccount\n10 - AWSAccount\n11 - GCPProject\n12 - OCICompartment\n13 - AzureSubscription\n14 - SalesforceAccount\n15 - GoogleWorkspace\n16 - ServicenowInstance\n17 - M365Tenant\n18 - EmailAccount\n19 - ActiveDirectoryAccount\n99 - Other: The account type is not mapped."}},"components/schemas/ocsfv1.8.0Actor":{"id":"components/schemas/ocsfv1.8.0Actor","kind":"json-schema","title":"ocsfv1.8.0Actor","data":{"title":"ocsfv1.8.0Actor","type":"object","description":"The Actor object contains details about the user, role, application, service, or process that initiated or performed a specific activity. Note that Actor is not the threat actor of a campaign but may be part of a campaign.","properties":{"app_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The client application or service that initiated the activity. This can be in conjunction with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"user"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present.  Note that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"app_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is distinct from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"process"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present."},"children":[],"type":"text"}],"type":"paragraph"}]},"app_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the client application or service that initiated the activity. This can be in conjunction with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"user"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present. Note that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"app_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is distinct from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"process.pid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"process.uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"idp":{"$ref":"#/components/schemas/ocsfv1.8.0Idp","nullable":true,"description":"This object describes details about the Identity Provider used."},"invoked_by":{"type":"string","nullable":true,"description":"The name of the service that invoked the activity as described in the event."},"process":{"$ref":"#/components/schemas/ocsfv1.8.0Process","nullable":true,"description":"The process that initiated the activity."},"session":{"$ref":"#/components/schemas/ocsfv1.8.0Session","nullable":true,"description":"The user session from which the activity was initiated."},"user":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The user that initiated the activity or the user context from which the activity was initiated."}}}},"components/schemas/ocsfv1.8.0Advisory":{"id":"components/schemas/ocsfv1.8.0Advisory","kind":"json-schema","title":"ocsfv1.8.0Advisory","data":{"title":"ocsfv1.8.0Advisory","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Advisory object represents publicly disclosed cybersecurity vulnerabilities defined in a Security advisory. e.g. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Microsoft KB Article"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Apple Security Advisory"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"GitHub Security Advisory (GHSA)"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"avg_timespan":{"$ref":"#/components/schemas/ocsfv1.8.0Timespan","nullable":true,"description":"The average time to patch."},"bulletin":{"type":"string","nullable":true,"description":"The Advisory bulletin identifier."},"classification":{"type":"string","nullable":true,"description":"The vendors classification of the Advisory."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the Advisory record was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the Advisory record was created."},"desc":{"type":"string","nullable":true,"description":"A brief description of the Advisory Record."},"install_state":{"type":"string","nullable":true,"description":"The install state of the Advisory."},"install_state_id":{"$ref":"#/components/schemas/ocsfv1.8.0Advisory_InstallStateId","nullable":true,"description":"The normalized install state ID of the Advisory."},"is_superseded":{"type":"boolean","nullable":true,"description":"The Advisory has been replaced by another."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the Advisory record was last updated."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the Advisory record was last updated."},"os":{"$ref":"#/components/schemas/ocsfv1.8.0Os","nullable":true,"description":"The operating system the Advisory applies to."},"product":{"$ref":"#/components/schemas/ocsfv1.8.0Product","nullable":true,"description":"The product where the vulnerability was discovered."},"references":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of reference URLs with additional information about the vulnerabilities disclosed in the Advisory."},"related_cves":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Cve"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of Common Vulnerabilities and Exposures "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cve.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"(CVE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" identifiers related to the vulnerabilities disclosed in the Advisory."},"children":[],"type":"text"}],"type":"paragraph"}]},"related_cwes":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Cwe"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of Common Weakness Enumeration "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"(CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" identifiers related to the vulnerabilities disclosed in the Advisory."},"children":[],"type":"text"}],"type":"paragraph"}]},"size":{"type":"integer","nullable":true,"description":"The size in bytes for the Advisory. Usually populated for a KB Article patch."},"src_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":"The Advisory link from the source vendor."},"title":{"type":"string","nullable":true,"description":"A title or a brief phrase summarizing the Advisory."},"uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier assigned to the advisory or disclosed vulnerability, e.g, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"GHSA-5mrr-rgp6-x4gr"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["uid"]}},"components/schemas/ocsfv1.8.0Advisory_InstallStateId":{"id":"components/schemas/ocsfv1.8.0Advisory_InstallStateId","kind":"json-schema","title":"ocsfv1.8.0Advisory_InstallStateId","data":{"title":"ocsfv1.8.0Advisory_InstallStateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AdvisoryInstallStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized install state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Installed: The item is installed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - NotInstalled: The item is not installed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - InstalledPendingReboot: The item is installed pending reboot operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The install state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"install_state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0AffectedCode":{"id":"components/schemas/ocsfv1.8.0AffectedCode","kind":"json-schema","title":"ocsfv1.8.0AffectedCode","data":{"title":"ocsfv1.8.0AffectedCode","type":"object","description":"The Affected Code object describes details about a code block identified as vulnerable.","properties":{"end_column":{"type":"integer","nullable":true,"description":"The column number of the last part of the assessed code identified as vulnerable."},"end_line":{"type":"integer","nullable":true,"description":"The line number of the last line of code block identified as vulnerable."},"file":{"$ref":"#/components/schemas/ocsfv1.8.0File","description":"Details about the file that contains the affected code block."},"owner":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"Details about the user that owns the affected file."},"remediation":{"$ref":"#/components/schemas/ocsfv1.8.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"rule":{"$ref":"#/components/schemas/ocsfv1.8.0Rule","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Details about the specific rule, e.g., those defined as part of a larger "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"policy"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", that triggered the finding."},"children":[],"type":"text"}],"type":"paragraph"}]},"start_column":{"type":"integer","nullable":true,"description":"The column number of the first part of the assessed code identified as vulnerable."},"start_line":{"type":"integer","nullable":true,"description":"The line number of the first line of code block identified as vulnerable."}},"required":["file"]}},"components/schemas/ocsfv1.8.0AffectedPackage":{"id":"components/schemas/ocsfv1.8.0AffectedPackage","kind":"json-schema","title":"ocsfv1.8.0AffectedPackage","data":{"title":"ocsfv1.8.0AffectedPackage","type":"object","description":"The Affected Package object describes details about a software package identified as affected by a vulnerability/vulnerabilities.","properties":{"architecture":{"type":"string","nullable":true,"description":"Architecture is a shorthand name describing the type of computer hardware the packaged software is meant to run on."},"cpe_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Platform Enumeration (CPE) name as described by ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://nvd.nist.gov/products/cpe"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpe:/a:apple:safari:16.2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"epoch":{"type":"integer","nullable":true,"description":"The software package epoch. Epoch is a way to define weighted dependencies based on version numbers."},"fixed_in_version":{"type":"string","nullable":true,"description":"The software package version in which a reported vulnerability was patched/fixed."},"hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":"Cryptographic hash to identify the binary instance of a software component. This can include any component such file, package, or library."},"license":{"type":"string","nullable":true,"description":"The software license applied to this package."},"license_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL pointing to the license applied on package or software. This is typically a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LICENSE.md"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" file within a repository."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","description":"The software package name."},"package_manager":{"type":"string","nullable":true,"description":"The software packager manager utilized to manage a package on a system, e.g. npm, yum, dpkg etc."},"package_manager_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL of the package or library at the package manager, or the specific URL or URI of an internal package manager link such as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AWS CodeArtifact"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Artifactory"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"path":{"$ref":"#/components/schemas/ocsfv1.8.0FilePath","nullable":true,"description":"The installation path of the affected package."},"purl":{"type":"string","nullable":true,"description":"A purl is a URL string used to identify and locate a software package in a mostly universal and uniform way across programming languages, package managers, packaging conventions, tools, APIs and databases."},"release":{"type":"string","nullable":true,"description":"Release is the number of times a version of the software has been packaged."},"remediation":{"$ref":"#/components/schemas/ocsfv1.8.0Remediation","nullable":true,"description":"Describes the recommended remediation steps to address identified issue(s)."},"src_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The link to the specific library or package such as within "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"GitHub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", this is different from the link to the package manager where the library or package is hosted."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of software package, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0AffectedPackage_TypeId","nullable":true,"description":"The type of software package."},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A unique identifier for the package or library reported by the source tool. E.g., the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"libId"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" within the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"sbom"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field of an OX Security Issue or the SPDX "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"components.*.bom-ref"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor who published the software package."},"version":{"type":"string","description":"The software package version."}},"required":["name","version"]}},"components/schemas/ocsfv1.8.0AffectedPackage_TypeId":{"id":"components/schemas/ocsfv1.8.0AffectedPackage_TypeId","kind":"json-schema","title":"ocsfv1.8.0AffectedPackage_TypeId","data":{"title":"ocsfv1.8.0AffectedPackage_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AffectedPackageTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Application: An application software package."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - OperatingSystem: An operating system software package."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Agent":{"id":"components/schemas/ocsfv1.8.0Agent","kind":"json-schema","title":"ocsfv1.8.0Agent","data":{"title":"ocsfv1.8.0Agent","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An Agent (also known as a Sensor) is typically installed on an Operating System (OS) and serves as a specialized software component that can be designed to monitor, detect, collect, archive, or take action. These activities and possible actions are defined by the upstream system controlling the Agent and its intended purpose. For instance, an Agent can include Endpoint Detection & Response (EDR) agents, backup/disaster recovery sensors, Application Performance Monitoring or profiling sensors, and similar software."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the agent or sensor. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AWS SSM Agent"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"policies":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Policy"},"nullable":true,"description":"Describes the various policies that may be applied or enforced by an agent or sensor. E.g., Conditional Access, prevention, auto-update, tamper protection, destination configuration, etc."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of the type_id value for the agent or sensor. In the case of 'Other' or 'Unknown', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Agent_TypeId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized representation of an agent or sensor. E.g., EDR, vulnerability management, APM, backup & recovery, etc."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The UID of the agent or sensor, sometimes known as a Sensor ID or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"aid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid_alt":{"type":"string","nullable":true,"description":"An alternative or contextual identifier for the agent or sensor, such as a configuration, organization, or license UID."},"vendor_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The company or author who created the agent or sensor. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Crowdstrike"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The semantic version of the agent or sensor, e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"7.101.50.0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0Agent_TypeId":{"id":"components/schemas/ocsfv1.8.0Agent_TypeId","kind":"json-schema","title":"ocsfv1.8.0Agent_TypeId","data":{"title":"ocsfv1.8.0Agent_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AgentTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool that provides similar threat detection, anti-malware, anti-ransomware, or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender for Endpoint, Wazuh."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that provides similar data classification, data loss detection, and/or data loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview, Symantec DLP."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Recovery: Any agent or sensor that provides backups, archival, or recovery capabilities. E.g., Azure Backup, AWS Backint Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Observability: Any agent or sensor that provides Application Performance Monitoring (APM), active tracing, profiling, or other observability use cases and optionally forwards the logs. E.g., New Relic Agent, Datadog Agent, Azure Monitor Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - VulnerabilityManagement: Any agent or sensor that provides vulnerability management or scanning capabilities. E.g., Qualys VMDR, Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party storage system such as a data lake or SIEM. E.g., Splunk Universal Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - MobileDeviceManagement: Any agent or sensor responsible for providing Mobile Device Management (MDM) or Mobile Enterprise Management (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - ConfigurationManagement: Any agent or sensor that provides configuration management of a device, such as scanning for software, license management, or applying configurations. E.g., AWS Systems Manager Agent, Flexera, ServiceNow MID Server."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - RemoteAccess: Any agent or sensor that provides remote access capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager Agent, Verkada Agent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0AnalysisTarget":{"id":"components/schemas/ocsfv1.8.0AnalysisTarget","kind":"json-schema","title":"ocsfv1.8.0AnalysisTarget","data":{"title":"ocsfv1.8.0AnalysisTarget","type":"object","description":"The analysis target defines the scope of monitored activities, specifying what entity, system or process is analyzed for activity patterns.","properties":{"name":{"type":"string","description":"The specific name or identifier of the analysis target, such as the username of a User Account, the name of a Kubernetes Cluster, the identifier of a Network Namespace, or the name of an Application Component."},"type":{"type":"string","nullable":true,"description":"The category of the analysis target, such as User Account, Kubernetes Cluster, Network Namespace, or Application Component."}},"required":["name"]}},"components/schemas/ocsfv1.8.0Analytic":{"id":"components/schemas/ocsfv1.8.0Analytic","kind":"json-schema","title":"ocsfv1.8.0Analytic","data":{"title":"ocsfv1.8.0Analytic","type":"object","description":"The Analytic object contains details about the analytic technique used to analyze and derive insights from the data or information that led to the creation of a finding or conclusion.","properties":{"algorithm":{"type":"string","nullable":true,"description":"The algorithm used by the underlying analytic to generate the finding."},"category":{"type":"string","nullable":true,"description":"The analytic category."},"desc":{"type":"string","nullable":true,"description":"The description of the analytic that generated the finding."},"name":{"type":"string","nullable":true,"description":"The name of the analytic that generated the finding."},"related_analytics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Object"},"nullable":true,"description":"Other analytics related to this analytic."},"state":{"type":"string","nullable":true,"description":"The Analytic state."},"state_id":{"$ref":"#/components/schemas/ocsfv1.8.0Analytic_StateId","nullable":true,"description":"The Analytic state identifier."},"type":{"type":"string","nullable":true,"description":"The analytic type."},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Analytic_TypeId","description":"The analytic type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the analytic that generated the finding."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The analytic version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["type_id"]}},"components/schemas/ocsfv1.8.0Analytic_StateId":{"id":"components/schemas/ocsfv1.8.0Analytic_StateId","kind":"json-schema","title":"ocsfv1.8.0Analytic_StateId","data":{"title":"ocsfv1.8.0Analytic_StateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AnalyticStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Active: The Analytic is active."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Suppressed: The Analytic is suppressed. For example, a user/customer has suppressed a particular detection signature in a security product."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Experimental: The Analytic is still under development and considered experimental."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Analytic_TypeId":{"id":"components/schemas/ocsfv1.8.0Analytic_TypeId","kind":"json-schema","title":"ocsfv1.8.0Analytic_TypeId","data":{"title":"ocsfv1.8.0Analytic_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AnalyticTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Rule: A Rule in security analytics refers to predefined criteria or conditions set to monitor, alert, or enforce policies, playing a crucial role in access control, threat detection, and regulatory compliance across security systems."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Behavioral: Behavioral analytics focus on monitoring and analyzing user or system actions to identify deviations from established patterns, aiding in the detection of insider threats, fraud, and advanced persistent threats (APTs)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Statistical: Statistical analytics pertains to analyzing data patterns and anomalies using statistical models to predict, detect, and respond to potential threats, enhancing overall security posture through informed decision-making."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - ML_DL_: Learning (ML/DL) encompasses techniques that can \"learn\" from known data to create analytics that generalize to new data. There may be a statistical component to these techniques, but it is not a requirement."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Fingerprinting: Fingerprinting is the technique of collecting detailed system data, including software versions and configurations, to enhance threat detection, data loss prevention (DLP), and endpoint detection and response (EDR) capabilities."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Tagging: Tagging refers to the practice of assigning labels or identifiers to data, users, assets, or activities to monitor, control access, and facilitate incident response across various security domains such as DLP and EDR."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - KeywordMatch: Keyword Match involves scanning content for specific terms to identify sensitive information, potential threats, or policy violations, aiding in DLP and compliance monitoring."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - RegularExpressions: Regular Expressions are used to define complex search patterns for identifying, validating, and extracting specific data sets or threats within digital content, enhancing DLP, EDR, and threat detection mechanisms."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - ExactDataMatch: Exact Data Match is a precise comparison technique used to detect the unauthorized use or exposure of specific, sensitive information, crucial for enforcing DLP policies and protecting against data breaches."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - PartialDataMatch: Partial Data Match involves identifying instances where segments of sensitive information or patterns match, facilitating nuanced DLP and threat detection without requiring complete data conformity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - IndexedDataMatch: Indexed Data Match refers to comparing content against a pre-compiled index of sensitive information to efficiently detect and prevent unauthorized access or breaches, streamlining DLP and compliance efforts."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Annotation":{"id":"components/schemas/ocsfv1.8.0Annotation","kind":"json-schema","title":"ocsfv1.8.0Annotation","data":{"title":"ocsfv1.8.0Annotation","type":"object","description":"A user or system-authored note or label, designed to be embedded in parent objects. Business context comes from the parent (for example, a detection finding or another record type), not from this object alone.","properties":{"content":{"type":"string","nullable":true,"description":"The content of the annotation."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the Annotation was created"},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the Annotation was created"},"creator":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The user that created the annotation."},"related_uids":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The unique identifiers of the related objects."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the annotation."}}}},"components/schemas/ocsfv1.8.0Anomaly":{"id":"components/schemas/ocsfv1.8.0Anomaly","kind":"json-schema","title":"ocsfv1.8.0Anomaly","data":{"title":"ocsfv1.8.0Anomaly","type":"object","description":"Describes an anomaly or deviation detected in a system. Anomalies are unexpected activity patterns that could indicate potential issues needing attention.","properties":{"observation_parameter":{"type":"string","description":"The specific parameter, metric or property where the anomaly was observed. Examples include: CPU usage percentage, API response time in milliseconds, HTTP error rate, memory utilization, network latency, transaction volume, etc. This helps identify the exact aspect of the system exhibiting anomalous behavior."},"observation_type":{"type":"string","nullable":true,"description":"The type of analysis methodology used to detect the anomaly. This indicates how the anomaly was identified through different analytical approaches. Common types include: Frequency Analysis, Time Pattern Analysis, Volume Analysis, Sequence Analysis, Distribution Analysis, etc."},"observations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observation"},"description":"Details about the observed anomaly or observations that were flagged as anomalous compared to expected baseline behavior."},"observed_pattern":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The specific pattern identified within the observation type. For Frequency Analysis, this could be 'FREQUENT', 'INFREQUENT', 'RARE', or 'UNSEEN'. For Time Pattern Analysis, this could be 'BUSINESS_HOURS', 'OFF_HOURS', or 'UNUSUAL_TIME'. For Volume Analysis, this could be 'NORMAL_VOLUME', 'HIGH_VOLUME', or 'SURGE'. The pattern values are specific to each observation type and indicate how the observed behavior relates to the baseline."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["observation_parameter","observations"]}},"components/schemas/ocsfv1.8.0AnomalyAnalysis":{"id":"components/schemas/ocsfv1.8.0AnomalyAnalysis","kind":"json-schema","title":"ocsfv1.8.0AnomalyAnalysis","data":{"title":"ocsfv1.8.0AnomalyAnalysis","type":"object","description":"Describes the analysis of activity patterns and anomalies of target entities to identify potential security threats, performance issues, or other deviations from established baselines. This includes monitoring and analyzing user interactions, API usage, resource utilization, access patterns and other measured indicators.","properties":{"analysis_targets":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0AnalysisTarget"},"description":"The analysis targets define the scope of monitored activities, specifying what entities, systems or processes are analyzed for activity patterns."},"anomalies":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Anomaly"},"description":"List of detected activities that significantly deviate from the established baselines. This can include unusual access patterns, unexpected user-agents, abnormal API usage, suspicious traffic spikes, unauthorized access attempts, and other activities that may indicate potential security threats or system issues."},"baselines":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Baseline"},"nullable":true,"description":"List of established patterns representing normal activity that serve as reference points for anomaly detection. This includes typical user interaction patterns like common user-agents, expected API access frequencies and patterns, standard resource utilization levels, and regular traffic flows. These baselines help establish what constitutes 'normal' activity in the system."}},"required":["analysis_targets","anomalies"]}},"components/schemas/ocsfv1.8.0Api":{"id":"components/schemas/ocsfv1.8.0Api","kind":"json-schema","title":"ocsfv1.8.0Api","data":{"title":"ocsfv1.8.0Api","type":"object","description":"The API, or Application Programming Interface, object represents  information pertaining to an API request and response.","properties":{"group":{"$ref":"#/components/schemas/ocsfv1.8.0Group","nullable":true,"description":"The information pertaining to the API group."},"operation":{"type":"string","description":"Verb/Operation associated with the request"},"request":{"$ref":"#/components/schemas/ocsfv1.8.0Request","nullable":true,"description":"Details pertaining to the API request."},"response":{"$ref":"#/components/schemas/ocsfv1.8.0Response","nullable":true,"description":"Details pertaining to the API response."},"service":{"$ref":"#/components/schemas/ocsfv1.8.0Service","nullable":true,"description":"The information pertaining to the API service."},"token":{"$ref":"#/components/schemas/ocsfv1.8.0Token","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The API or client token used to authenticate or authorize the API request. This attribute contains the base "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"token"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object that represents: (1) IdP-issued client tokens (type_id: 6) such as Okta API tokens or Microsoft Entra ID Application Registration client secrets, or (2) generic API tokens/keys (type_id: 7) used for SaaS application authentication. Use this attribute when the API request was authenticated using a token that should be tracked as part of the API activity event. Note: Protocol-specific authentication tokens (Kerberos, OIDC, SAML) should be represented using "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authentication_token"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in authentication events, not in API activity events."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":"The version of the API service."}},"required":["operation"]}},"components/schemas/ocsfv1.8.0Application":{"id":"components/schemas/ocsfv1.8.0Application","kind":"json-schema","title":"ocsfv1.8.0Application","data":{"title":"ocsfv1.8.0Application","type":"object","description":"An Application describes the details for an inventoried application as reported by an Application Security tool or other Developer-centric tooling. Applications can be defined as Kubernetes resources, Containerized resources, or application hosting-specific cloud sources such as AWS Elastic BeanStalk, AWS Lightsail, or Azure Logic Apps.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the application was known to have been created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the application was known to have been created."},"criticality":{"type":"string","nullable":true,"description":"The criticality of the application as defined by the event source."},"data":{"nullable":true,"description":"Additional data describing the application."},"desc":{"type":"string","nullable":true,"description":"A description or commentary for an application, usually retrieved from an upstream system."},"first_seen_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The initial discovery time of the application."},"first_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The initial discovery time of the application."},"group":{"$ref":"#/components/schemas/ocsfv1.8.0Group","nullable":true,"description":"The name of the related application or associated resource group."},"hostname":{"$ref":"#/components/schemas/ocsfv1.8.0Hostname","nullable":true,"description":"The fully qualified name of the application."},"is_disabled":{"type":"boolean","nullable":true,"description":"Indicates whether the application is disabled."},"is_publisher_verified":{"type":"boolean","nullable":true,"description":"Indicates whether the platform the application is registered in has verified its publisher."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels associated to the application."},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The most recent discovery time of the application."},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent discovery time of the application."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the application was last known to have been modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the application was last known to have been modified."},"name":{"type":"string","nullable":true,"description":"The name of the application."},"owner":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The identity of the service or user account that owns the application."},"product":{"$ref":"#/components/schemas/ocsfv1.8.0Product","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The software product that this application is an instance of, carrying product identity such as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"vendor_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpe_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", and canonical "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"version"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"programmatic_credentials":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ProgrammaticCredential"},"nullable":true,"description":"The credentials registered for the application, such as client secrets and certificates."},"publisher_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The application publisher type, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"publisher_type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"publisher_type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Application_PublisherTypeId","nullable":true,"description":"The normalized identifier of the application's publisher type, relative to the organization or tenant the application is registered in or connected to."},"region":{"type":"string","nullable":true,"description":"The cloud region of the resource."},"requested_access_grants":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0AccessGrant"},"nullable":true,"description":"The access the application requests, whether or not it has been granted."},"resource_relationship":{"$ref":"#/components/schemas/ocsfv1.8.0Graph","nullable":true,"description":"A graph representation showing how this application relates to and interacts with other entities in the environment. This can include parent/child relationships, dependencies, or other connections."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0Application_RiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"sbom":{"$ref":"#/components/schemas/ocsfv1.8.0Sbom","nullable":true,"description":"The Software Bill of Materials (SBOM) associated with the application"},"src_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":"URL pointing to the source of the application in the event source."},"sso":{"$ref":"#/components/schemas/ocsfv1.8.0Sso","nullable":true,"description":"The single sign-on configuration of the application."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the application."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of application as defined by the event source, e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"GitHub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Azure Logic App"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Amazon Elastic BeanStalk"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"The unique identifier for the application."},"uid_alt":{"type":"string","nullable":true,"description":"An alternative or contextual identifier for the application, such as a configuration, organization, or license UID."},"url":{"$ref":"#/components/schemas/ocsfv1.8.0Url","nullable":true,"description":"The URL of the application."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The semantic version of the application, e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.7.4"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0Application_PublisherTypeId":{"id":"components/schemas/ocsfv1.8.0Application_PublisherTypeId","kind":"json-schema","title":"ocsfv1.8.0Application_PublisherTypeId","data":{"title":"ocsfv1.8.0Application_PublisherTypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ApplicationPublisherTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The publisher type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - PlatformVendor: Published by the vendor of the platform the entity is registered in or runs on."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Internal: Published by the organization or tenant itself."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - ThirdParty: Published by another organization."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The publisher type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"publisher_type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Application_RiskLevelId":{"id":"components/schemas/ocsfv1.8.0Application_RiskLevelId","kind":"json-schema","title":"ocsfv1.8.0Application_RiskLevelId","data":{"title":"ocsfv1.8.0Application_RiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ApplicationRiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Assessment":{"id":"components/schemas/ocsfv1.8.0Assessment","kind":"json-schema","title":"ocsfv1.8.0Assessment","data":{"title":"ocsfv1.8.0Assessment","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Assessment object describes a point-in-time assessment, check, or evaluation of a specific configuration or signal against an asset, entity, person, or otherwise. For example, this can encapsulate "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"os_signals"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from CrowdStrike Falcon Zero Trust Assessments, or account for "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Datastore"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" configurations from Cyera, or capture details of Microsoft Intune configuration policies."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"category":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The category that the assessment is part of. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Prevention"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Windows 10"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"desc":{"type":"string","nullable":true,"description":"The description of the assessment criteria, or a description of the specific configuration or signal the assessment is targeting."},"meets_criteria":{"type":"boolean","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Determines whether the assessment against the specific configuration or signal meets the assessments criteria. For example, if the assessment checks if a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Datastore"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is encrypted or not, having encryption would be evaluated as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the configuration or signal being assessed. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Kernel Mode Code Integrity (KMCI)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"publicAccessibilityState"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The details of any policy associated with an assessment."},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the configuration or signal being assessed. For example: the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"signal_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["meets_criteria"]}},"components/schemas/ocsfv1.8.0Attack":{"id":"components/schemas/ocsfv1.8.0Attack","kind":"json-schema","title":"ocsfv1.8.0Attack","data":{"title":"ocsfv1.8.0Attack","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE ATT&CK® & ATLAS™ object describes the tactic, technique, sub-technique & mitigation associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"mitigation":{"$ref":"#/components/schemas/ocsfv1.8.0Mitigation","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Mitigation object describes the MITRE ATT&CK® or ATLAS™ Mitigation ID and/or name that is associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}]},"sub_technique":{"$ref":"#/components/schemas/ocsfv1.8.0SubTechnique","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Sub-technique object describes the MITRE ATT&CK® or ATLAS™ Sub-technique ID and/or name associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}]},"tactic":{"$ref":"#/components/schemas/ocsfv1.8.0Tactic","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Tactic object describes the MITRE ATT&CK® or ATLAS™ Tactic ID and/or name that is associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}]},"tactics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Tactic"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Tactic object describes the tactic ID and/or tactic name that are associated with the attack technique, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK® Matrix"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"technique":{"$ref":"#/components/schemas/ocsfv1.8.0Technique","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Technique object describes the MITRE ATT&CK® or ATLAS™ Technique ID and/or name associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The ATT&CK® or ATLAS™ Matrix version."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0AuthFactor":{"id":"components/schemas/ocsfv1.8.0AuthFactor","kind":"json-schema","title":"ocsfv1.8.0AuthFactor","data":{"title":"ocsfv1.8.0AuthFactor","type":"object","description":"An Authentication Factor object describes a category of methods used for identity verification in an authentication attempt.","properties":{"device":{"$ref":"#/components/schemas/ocsfv1.8.0Device","nullable":true,"description":"Device used to complete an authentication request."},"email_addr":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress","nullable":true,"description":"The email address used in an email-based authentication factor."},"factor_type":{"type":"string","nullable":true,"description":"The type of authentication factor used in an authentication attempt."},"factor_type_id":{"$ref":"#/components/schemas/ocsfv1.8.0AuthFactor_FactorTypeId","description":"The normalized identifier for the authentication factor."},"is_hotp":{"type":"boolean","nullable":true,"description":"Whether the authentication factor is an HMAC-based One-time Password (HOTP)."},"is_totp":{"type":"boolean","nullable":true,"description":"Whether the authentication factor is a Time-based One-time Password (TOTP)."},"phone_number":{"type":"string","nullable":true,"description":"The phone number used for a telephony-based authentication request."},"provider":{"type":"string","nullable":true,"description":"The name of provider for an authentication factor."},"security_questions":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The question(s) provided to user for a question-based authentication factor."}},"required":["factor_type_id"]}},"components/schemas/ocsfv1.8.0AuthFactor_FactorTypeId":{"id":"components/schemas/ocsfv1.8.0AuthFactor_FactorTypeId","kind":"json-schema","title":"ocsfv1.8.0AuthFactor_FactorTypeId","data":{"title":"ocsfv1.8.0AuthFactor_FactorTypeId","type":"integer","description":"AuthFactorFactorTypeId is an enum, and the following values are allowed.\n0 - Unknown\n1 - SMS: User receives and inputs a code sent to their mobile device via SMS text message.\n2 - SecurityQuestion: The user responds to a security question as part of a question-based authentication factor\n3 - PhoneCall: System calls the user's registered phone number and requires the user to answer and provide a response.\n4 - Biometric: Devices that verify identity-based on user's physical identifiers, such as fingerprint scanners or retina scanners.\n5 - PushNotification: Push notification is sent to user's registered device and requires the user to acknowledge.\n6 - HardwareToken: Physical device that generates a code to be used for authentication.\n7 - OTP: Application generates a one-time password (OTP) for use in authentication.\n8 - Email: A code or link is sent to a user's registered email address.\n9 - U2F: Typically involves a hardware token, which the user physically interacts with to authenticate.\n10 - WebAuthn: Web-based API that enables users to register devices as authentication factors.\n11 - Password: The user enters a password that they have previously established.\n99 - Other"}},"components/schemas/ocsfv1.8.0Authorization":{"id":"components/schemas/ocsfv1.8.0Authorization","kind":"json-schema","title":"ocsfv1.8.0Authorization","data":{"title":"ocsfv1.8.0Authorization","type":"object","description":"The Authorization Result object provides details about the authorization outcome and associated policies related to activity.","properties":{"decision":{"type":"string","nullable":true,"description":"Authorization Result/outcome, e.g. allowed, denied."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"Details about the Identity/Access management policies that are applicable."}}}},"components/schemas/ocsfv1.8.0AutonomousSystem":{"id":"components/schemas/ocsfv1.8.0AutonomousSystem","kind":"json-schema","title":"ocsfv1.8.0AutonomousSystem","data":{"title":"ocsfv1.8.0AutonomousSystem","type":"object","description":"An autonomous system (AS) is a collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators on behalf of a single administrative entity or domain that presents a common, clearly defined routing policy to the internet.","properties":{"name":{"type":"string","nullable":true,"description":"Organization name for the Autonomous System."},"number":{"type":"integer","nullable":true,"description":"Unique number that the AS is identified by."}}}},"components/schemas/ocsfv1.8.0Baseline":{"id":"components/schemas/ocsfv1.8.0Baseline","kind":"json-schema","title":"ocsfv1.8.0Baseline","data":{"title":"ocsfv1.8.0Baseline","type":"object","description":"Describes the baseline or expected behavior of a system, service, or component based on historical observations and measurements. It establishes reference points for comparison to detect anomalies, trends, and deviations from typical patterns.","properties":{"observation_parameter":{"type":"string","description":"The specific parameter or property being monitored. Examples include: CPU usage percentage, API response time in milliseconds, HTTP error rate, memory utilization, network latency, transaction volume, etc."},"observation_type":{"type":"string","nullable":true,"description":"The type of analysis being performed to establish baseline behavior. Common types include: Frequency Analysis, Time Pattern Analysis, Volume Analysis, Sequence Analysis, Distribution Analysis, etc."},"observations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observation"},"description":"Collection of actual measured values, data points and observations recorded for this baseline."},"observed_pattern":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The specific pattern identified within the observation type. For Frequency Analysis, this could be 'FREQUENT', 'INFREQUENT', 'RARE', or 'UNSEEN'. For Time Pattern Analysis, this could be 'BUSINESS_HOURS', 'OFF_HOURS', or 'UNUSUAL_TIME'. For Volume Analysis, this could be 'NORMAL_VOLUME', 'HIGH_VOLUME', or 'SURGE'. The pattern values are specific to each observation type and indicate the baseline behavior."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["observation_parameter","observations"]}},"components/schemas/ocsfv1.8.0Campaign":{"id":"components/schemas/ocsfv1.8.0Campaign","kind":"json-schema","title":"ocsfv1.8.0Campaign","data":{"title":"ocsfv1.8.0Campaign","type":"object","description":"Campaign represent organized efforts by threat actors to achieve malicious objectives over a period, often characterized by shared tactics, techniques, and procedures (TTPs).","properties":{"name":{"type":"string","description":"The name of a specific campaign associated with a cyber threat."}},"required":["name"]}},"components/schemas/ocsfv1.8.0Certificate":{"id":"components/schemas/ocsfv1.8.0Certificate","kind":"json-schema","title":"ocsfv1.8.0Certificate","data":{"title":"ocsfv1.8.0Certificate","type":"object","description":"The Digital Certificate, also known as a Public Key Certificate, object contains information about the ownership and usage of a public key. It serves as a means to establish trust in the authenticity and integrity of the public key and the associated entity.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the certificate was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the certificate was created."},"expiration_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The expiration time of the certificate."},"expiration_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The expiration time of the certificate."},"fingerprints":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint"},"nullable":true,"description":"The fingerprint list of the certificate."},"is_self_signed":{"type":"boolean","nullable":true,"description":"Denotes whether a digital certificate is self-signed or signed by a known certificate authority (CA)."},"issuer":{"type":"string","description":"The certificate issuer distinguished name."},"sans":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0San"},"nullable":true,"description":"The list of subject alternative names that are secured by a specific certificate."},"serial_number":{"type":"string","description":"The serial number of the certificate used to create the digital signature."},"subject":{"type":"string","nullable":true,"description":"The certificate subject distinguished name."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the certificate."},"version":{"type":"string","nullable":true,"description":"The certificate version."}},"required":["issuer","serial_number"]}},"components/schemas/ocsfv1.8.0ChatMessage":{"id":"components/schemas/ocsfv1.8.0ChatMessage","kind":"json-schema","title":"ocsfv1.8.0ChatMessage","data":{"title":"ocsfv1.8.0ChatMessage","type":"object","description":"The Chat Message object describes a message sent in an enterprise chat platform such as Microsoft Teams, Slack, or AI assistants like Microsoft 365 Copilot.","properties":{"conversation_uid":{"type":"string","nullable":true,"description":"The unique identifier of the conversation: a channel, chat, or AI session."},"files":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0File"},"nullable":true,"description":"Files attached to the chat message."},"message":{"type":"string","nullable":true,"description":"The plain-text content of the message."},"parent_uid":{"type":"string","nullable":true,"description":"The uid of the top-level message this message replies to, which identifies its thread. Absent for a top-level message."},"request_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"For AI interactions, the unique identifier linking a user prompt to its AI response. Messages with the same request_uid form a prompt/response pair."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the message within its conversation."}}}},"components/schemas/ocsfv1.8.0Check":{"id":"components/schemas/ocsfv1.8.0Check","kind":"json-schema","title":"ocsfv1.8.0Check","data":{"title":"ocsfv1.8.0Check","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The check object defines a specific, testable compliance verification point that evaluates a target device against a standard, framework, or custom requirement. While checks are typically associated with formal standards (like CIS, NIST, or ISO), they can also represent custom or organizational requirements. When mapped to controls, checks can evaluate specific control_parameters to determine compliance status, but neither the control mapping nor control_parameters are required for a valid check."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"desc":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The detailed description of the compliance check, explaining the security requirement, vulnerability, or configuration being assessed. For example, CIS: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cramfs filesystem type is a compressed read-only Linux filesystem. Removing support for unneeded filesystem types reduces the local attack surface."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or DISA STIG: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Unauthorized access to the information system by foreign entities may result in loss or compromise of data."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name or title of the compliance check. For example, CIS: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Ensure mounting of cramfs filesystems is disabled"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or DISA STIG: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Ubuntu operating system must implement DoD-approved encryption to protect the confidentiality of remote access sessions"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"resource":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails","nullable":true,"description":"Describes details about the resource that this check evaluated."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The severity level as defined in the source document. For example CIS Benchmarks, valid values are: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Level 1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (security-forward, essential settings), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Level 2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (security-focused environment, more restrictive), or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Scored/Not Scored"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (whether compliance can be automatically checked). For DISA STIG, valid values are: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CAT I"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (maps to severity_id 5/Critical), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CAT II"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (maps to severity_id 4/High), or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CAT III"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (maps to severity_id 3/Medium)."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0Check_SeverityId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized severity identifier that maps severity levels to standard severity levels. For example CIS Benchmark: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Level 2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" maps to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"4"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (High), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Level 1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" maps to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (Medium). For DISA STIG: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CAT I"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" maps to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"5"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (Critical), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CAT II"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" maps to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"4"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (High), and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CAT III"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" maps to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (Medium)."},"children":[],"type":"text"}],"type":"paragraph"}]},"standards":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The regulatory or industry standard this check is associated with. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"PCI DSS 3.2.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"HIPAA Security Rule"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST SP 800-53 Rev. 5"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ISO/IEC 27001:2013"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The resultant status of the compliance check normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. For example, CIS Benchmark: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Pass"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" when all requirements are met, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Fail"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" when requirements are not met, or DISA STIG: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NotAFinding"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (maps to status_id 1/Pass), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Open"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (maps to status_id 3/Fail)."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0Check_StatusId","nullable":true,"description":"The normalized status identifier of the compliance check."},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the compliance check within its standard or framework. For example, CIS Benchmark identifier "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.1.1.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", DISA STIG identifier "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"V-230234"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or NIST control identifier "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AC-17(2)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The check version. For example, CIS Benchmark: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.1.0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for Amazon Linux 2 or DISA STIG: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"V2R1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for Windows 10."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0Check_SeverityId":{"id":"components/schemas/ocsfv1.8.0Check_SeverityId","kind":"json-schema","title":"ocsfv1.8.0Check_SeverityId","data":{"title":"ocsfv1.8.0Check_SeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CheckSeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Maps to CIS Benchmark "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Level 1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" - Essential security settings recommended for all systems, or DISA STIG "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CAT III"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" - Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Maps to CIS Benchmark "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Level 2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" - More restrictive and security-focused settings for sensitive environments, or DISA STIG "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CAT II"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" - Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Maps to DISA STIG "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CAT I"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" - Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Check_StatusId":{"id":"components/schemas/ocsfv1.8.0Check_StatusId","kind":"json-schema","title":"ocsfv1.8.0Check_StatusId","data":{"title":"ocsfv1.8.0Check_StatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CheckStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Pass: The compliance check passed for all the evaluated resources."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Warning: The compliance check did not yield a result due to missing information."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Fail: The compliance check failed for at least one of the evaluated resources."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0CisControl":{"id":"components/schemas/ocsfv1.8.0CisControl","kind":"json-schema","title":"ocsfv1.8.0CisControl","data":{"title":"ocsfv1.8.0CisControl","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CIS Control (aka Critical Security Control) object describes a prioritized set of actions to protect your organization and data from cyber-attack vectors. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.cisecurity.org/controls"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CIS Controls"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" are defined by the Center for Internet Security."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"desc":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CIS Control description. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"i","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"name":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CIS Control name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"i","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CIS Control version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"i","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"v8"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["name"]}},"components/schemas/ocsfv1.8.0Cloud":{"id":"components/schemas/ocsfv1.8.0Cloud","kind":"json-schema","title":"ocsfv1.8.0Cloud","data":{"title":"ocsfv1.8.0Cloud","type":"object","description":"The Cloud object describes the cloud computing environment where an event or finding originated. It provides comprehensive context about the cloud infrastructure, including the cloud service provider, account or subscription details, organizational structure, geographic regions, availability zones, and logical partitions.","properties":{"account":{"$ref":"#/components/schemas/ocsfv1.8.0Account","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Account object containing details about the cloud account, subscription, or billing unit where the event or finding was created. This object includes properties such as the account name, unique identifier, type, labels, and tags."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Examples:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AWS:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Account object with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (Account ID), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", and other account properties"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Azure:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Subscription object with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (Subscription ID), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", and subscription metadata"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"GCP:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Project object with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (Project ID), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", and project attributes"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Oracle Cloud:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Compartment object with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (Tenancy OCID), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", and compartment details"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"cloud_partition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The logical grouping or isolated segment within a cloud provider's infrastructure where the event or finding was created, often used for compliance, governance, or regional separation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Examples:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AWS:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Partition where the event occurred ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"aws"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"aws-cn"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"aws-us-gov"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Azure:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Cloud environment where the event occurred ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AzureCloud"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AzureUSGovernment"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AzureChinaCloud"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"org":{"$ref":"#/components/schemas/ocsfv1.8.0Organization","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Organization object containing details about the organizational unit or management structure that governs the account, subscription, or project where the event or finding was created. This object includes properties such as the organization name, unique identifier, type, and other organizational metadata."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Examples:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AWS:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Organization object with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (Organization ID), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", and other organizational properties"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Azure:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Management Group object with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (Management Group ID), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", and management group metadata"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"GCP:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Organization object with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (Organization ID), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", and organizational attributes"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Oracle Cloud:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Tenancy object with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (Tenancy OCID), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", and tenancy details"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"project_uid":{"type":"string","nullable":true,"description":"The unique identifier of a Cloud project."},"provider":{"type":"string","description":"The unique name of the Cloud services provider where the event or finding was created. Examples include AWS, Azure, GCP (Google Cloud Platform), Oracle Cloud, IBM Cloud, Alibaba Cloud, or other public, private, or hybrid cloud providers."},"region":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cloud region where the event or finding was created, as defined by the cloud provider."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Examples:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AWS:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Region where the event occurred ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-east-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"eu-west-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Azure:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Region where the event occurred ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"East US"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"West Europe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"GCP:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Region where the event occurred ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-central1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"europe-west1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Oracle Cloud:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Region where the event occurred ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-ashburn-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"uk-london-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"zone":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The availability zone in the cloud region where the event or finding was created, as defined by the cloud provider."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Examples:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AWS:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Availability zone where the event occurred ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-east-1a"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-east-1b"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Azure:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Availability zone where the event occurred ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" within a region)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"GCP:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Availability zone where the event occurred ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-central1-a"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"us-central1-b"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Oracle Cloud:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Availability zone where the event occurred ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AD-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AD-2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AD-3"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"required":["provider"]}},"components/schemas/ocsfv1.8.0Compliance":{"id":"components/schemas/ocsfv1.8.0Compliance","kind":"json-schema","title":"ocsfv1.8.0Compliance","data":{"title":"ocsfv1.8.0Compliance","type":"object","description":"The Compliance object contains information about Industry and Regulatory Framework standards, controls and requirements or details about custom assessments utilized in a compliance evaluation. Standards define broad security frameworks, controls represent specific security requirements within those frameworks, and checks are the testable verification points used to determine if controls are properly implemented.","properties":{"assessments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Assessment"},"nullable":true,"description":"A list of assessments associated with the compliance requirements evaluation."},"category":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The category a control framework pertains to, as reported by the source tool, such as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Asset Management"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Risk Assessment"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"checks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Check"},"nullable":true,"description":"A list of compliance checks associated with specific industry standards or frameworks. Each check represents an individual rule or requirement that has been evaluated against a target device. Checks typically include details such as the check name (e.g., CIS: 'Ensure mounting of cramfs filesystems is disabled' or DISA STIG descriptive titles), unique identifiers (such as CIS identifier '1.1.1.1' or DISA STIG identifier 'V-230234'), descriptions (detailed explanations of security requirements or vulnerability discussions), and version information."},"compliance_references":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KbArticle"},"nullable":true,"description":"A list of reference KB articles that provide information to help organizations understand, interpret, and implement compliance standards. They provide guidance, best practices, and examples."},"compliance_standards":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KbArticle"},"nullable":true,"description":"A list of established guidelines or criteria that define specific requirements an organization must follow."},"control":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A Control is a prescriptive, actionable set of specifications that strengthens device posture. The control specifies required security measures, while the specific implementation values are defined in control_parameters. E.g., CIS AWS Foundations Benchmark 1.2.0 - Control 2.1 - Ensure CloudTrail is enabled in all regions"},"children":[],"type":"text"}],"type":"paragraph"}]},"control_parameters":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of control parameters evaluated in a Compliance check. E.g., parameters for CloudTrail configuration might include "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"multiRegionTrailEnabled: true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"logFileValidationEnabled: true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"requiredRegions: [us-east-1, us-west-2]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"control_uid":{"type":"string","nullable":true,"description":"The unique identifier of the control in the source GRC system that this evaluation was performed against."},"desc":{"type":"string","nullable":true,"description":"The description or criteria of a control."},"requirements":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The specific compliance requirements being evaluated. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"PCI DSS Requirement 8.2.3 - Passwords must meet minimum complexity requirements"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"HIPAA Security Rule 164.312(a)(2)(iv) - Implement encryption and decryption mechanisms"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"standards":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The regulatory or industry standards being evaluated for compliance."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The resultant status of the compliance check normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":"The resultant status code of the compliance check."},"status_detail":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The contextual description of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status, status_code"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" values."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_details":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of contextual descriptions of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status, status_code"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" values."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0Compliance_StatusId","nullable":true,"description":"The normalized status identifier of the compliance check."}}}},"components/schemas/ocsfv1.8.0Compliance_StatusId":{"id":"components/schemas/ocsfv1.8.0Compliance_StatusId","kind":"json-schema","title":"ocsfv1.8.0Compliance_StatusId","data":{"title":"ocsfv1.8.0Compliance_StatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ComplianceStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Pass: The compliance check passed for all the evaluated resources."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Warning: The compliance check did not yield a result due to missing information."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Fail: The compliance check failed for at least one of the evaluated resources."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0ComplianceControl":{"id":"components/schemas/ocsfv1.8.0ComplianceControl","kind":"json-schema","title":"ocsfv1.8.0ComplianceControl","data":{"title":"ocsfv1.8.0ComplianceControl","type":"object","description":"A security or compliance control defined in a GRC platform: a specific policy, procedure, or technical measure that must be in place. Controls are mapped to framework requirements and validated by tests. Status attributes are populated where the source exposes them; in some providers control status is available only on the detail endpoint.","properties":{"assessment_status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The assessment result, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"assessment_status_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is the value reported by the data source."},"children":[],"type":"text"}],"type":"paragraph"}]},"assessment_status_id":{"$ref":"#/components/schemas/ocsfv1.8.0ComplianceControl_AssessmentStatusId","nullable":true,"description":"The normalized assessment result of the control."},"category":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The category or domain of the control. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Access Management"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the control was created in the source system."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the control was created in the source system."},"desc":{"type":"string","nullable":true,"description":"The description or criteria of the control."},"failing_tests_count":{"type":"integer","nullable":true,"description":"The number of mapped tests currently failing."},"first_failed_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the control first entered a failing state."},"first_failed_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the control first entered a failing state."},"implementation_status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The implementation state, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"implementation_status_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is the value reported by the data source."},"children":[],"type":"text"}],"type":"paragraph"}]},"implementation_status_id":{"$ref":"#/components/schemas/ocsfv1.8.0ComplianceControl_ImplementationStatusId","nullable":true,"description":"The normalized implementation state of the control."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the control was last updated in the source system."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the control was last updated in the source system."},"name":{"type":"string","description":"The name of the control."},"owner":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The user who owns the control."},"passing_tests_count":{"type":"integer","nullable":true,"description":"The number of mapped tests currently passing."},"standards":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The compliance standards this control belongs to, as reported by the provider. Values are the provider's own framework identifiers, passed through unmodified (not normalized across providers)."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the control in the source GRC system."},"vendor_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The provider-internal code for the control (for example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DCF-1002"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"). This is the provider's own identifier, distinct from the framework identifiers carried in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"standards"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["name"]}},"components/schemas/ocsfv1.8.0ComplianceControl_AssessmentStatusId":{"id":"components/schemas/ocsfv1.8.0ComplianceControl_AssessmentStatusId","kind":"json-schema","title":"ocsfv1.8.0ComplianceControl_AssessmentStatusId","data":{"title":"ocsfv1.8.0ComplianceControl_AssessmentStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ComplianceControlAssessmentStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The assessment result is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Pass: The control or test passed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Warning: The assessment did not yield a definitive result."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Fail: The control or test failed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - NotAssessed: The control or test has not been assessed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - NotApplicable: The control or test is not applicable."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The assessment status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"assessment_status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0ComplianceControl_ImplementationStatusId":{"id":"components/schemas/ocsfv1.8.0ComplianceControl_ImplementationStatusId","kind":"json-schema","title":"ocsfv1.8.0ComplianceControl_ImplementationStatusId","data":{"title":"ocsfv1.8.0ComplianceControl_ImplementationStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ComplianceControlImplementationStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The implementation state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - NotImplemented: The control is not implemented."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Partial: The control is partially implemented."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Implemented: The control is fully implemented."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The implementation status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"implementation_status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0ComplianceEvidence":{"id":"components/schemas/ocsfv1.8.0ComplianceEvidence","kind":"json-schema","title":"ocsfv1.8.0ComplianceEvidence","data":{"title":"ocsfv1.8.0ComplianceEvidence","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An auditor-facing documentation artifact that proves a control is working: a file, screenshot, export, signed attestation, or link. Distinct from OCSF "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Evidences"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", which describes telemetry behind a security detection. This object is the artifact record and its association to the control or test it supports."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"control_uid":{"type":"string","nullable":true,"description":"The identifier of the control this evidence supports."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the evidence was collected or created in the source system."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the evidence was collected or created in the source system."},"desc":{"type":"string","nullable":true,"description":"A description of the evidence."},"evidence_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The evidence type, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"evidence_type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is the value reported by the data source."},"children":[],"type":"text"}],"type":"paragraph"}]},"evidence_type_id":{"$ref":"#/components/schemas/ocsfv1.8.0ComplianceEvidence_EvidenceTypeId","nullable":true,"description":"The normalized type of the evidence artifact."},"is_accepted":{"type":"boolean","nullable":true,"description":"Whether the evidence has been accepted, where the source tracks acceptance."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the evidence was last updated in the source system."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the evidence was last updated in the source system."},"name":{"type":"string","nullable":true,"description":"The name or title of the evidence artifact, where the source exposes it."},"standards":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The compliance standards this evidence contributes to, as reported by the provider. Values are the provider's own framework identifiers, passed through unmodified (not normalized across providers)."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the evidence in the source GRC system."}}}},"components/schemas/ocsfv1.8.0ComplianceEvidence_EvidenceTypeId":{"id":"components/schemas/ocsfv1.8.0ComplianceEvidence_EvidenceTypeId","kind":"json-schema","title":"ocsfv1.8.0ComplianceEvidence_EvidenceTypeId","data":{"title":"ocsfv1.8.0ComplianceEvidence_EvidenceTypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ComplianceEvidenceEvidenceTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The evidence type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Document: A document or file."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Screenshot: A screenshot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Export: A data export."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Link: A link to an external artifact."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Attestation: A signed attestation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The evidence type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"evidence_type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0ComplianceFramework":{"id":"components/schemas/ocsfv1.8.0ComplianceFramework","kind":"json-schema","title":"ocsfv1.8.0ComplianceFramework","data":{"title":"ocsfv1.8.0ComplianceFramework","type":"object","description":"A compliance standard or regulatory framework that an organization is tracking in a GRC platform, such as SOC 2, ISO 27001, HIPAA, PCI DSS, NIST SP 800-53, or FedRAMP, along with its aggregate posture counts.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the framework was added to the source system."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the framework was added to the source system."},"desc":{"type":"string","nullable":true,"description":"A description of the framework."},"failing_tests_count":{"type":"integer","nullable":true,"description":"The number of tests for this framework currently failing."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the framework was last updated in the source system."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the framework was last updated in the source system."},"name":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The display name of the framework. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SOC 2 Type II"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"passing_tests_count":{"type":"integer","nullable":true,"description":"The number of applicable tests currently passing."},"standard":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The compliance standard identifier as reported by the provider (for example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"SOC_2"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"ISO_27001"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"CIS_IG1"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"). This is the provider's own identifier, passed through unmodified; Synqly does not normalize standard identifiers across providers."},"children":[],"type":"text"}],"type":"paragraph"}]},"total_controls_count":{"type":"integer","nullable":true,"description":"The total number of controls applicable to this framework."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the framework in the source GRC system."}},"required":["name"]}},"components/schemas/ocsfv1.8.0ComplianceTest":{"id":"components/schemas/ocsfv1.8.0ComplianceTest","kind":"json-schema","title":"ocsfv1.8.0ComplianceTest","data":{"title":"ocsfv1.8.0ComplianceTest","type":"object","description":"An automated evaluation that verifies whether a control is being met. Tests run continuously or on a schedule and carry a current pass/fail status. In some providers tests are the only place a pass/fail signal is exposed. This object is a persistent test definition with its current result, not a point-in-time finding.","properties":{"assessment_status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The test result, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"assessment_status_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is the value reported by the data source."},"children":[],"type":"text"}],"type":"paragraph"}]},"assessment_status_id":{"$ref":"#/components/schemas/ocsfv1.8.0ComplianceTest_AssessmentStatusId","nullable":true,"description":"The normalized current result of the test."},"category":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The category or domain of the test. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Account security"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Infrastructure"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"control_uids":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The identifiers of the controls this test validates."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the test was created in the source system."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the test was created in the source system."},"desc":{"type":"string","nullable":true,"description":"A description of what the test verifies."},"failure_message":{"type":"string","nullable":true,"description":"The message describing why the test is currently failing."},"last_evaluated_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the test was last evaluated."},"last_evaluated_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the test was last evaluated."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the test was last updated in the source system."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the test was last updated in the source system."},"name":{"type":"string","description":"The name of the test."},"owner":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The user who owns the test."},"remediation":{"$ref":"#/components/schemas/ocsfv1.8.0Remediation","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The recommended remediation steps to bring the test into a passing state. The steps are carried in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"remediation.desc"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"standards":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The compliance standards this test contributes to, as reported by the provider. Values are the provider's own framework identifiers, passed through unmodified (not normalized across providers)."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the test in the source GRC system."}},"required":["name"]}},"components/schemas/ocsfv1.8.0ComplianceTest_AssessmentStatusId":{"id":"components/schemas/ocsfv1.8.0ComplianceTest_AssessmentStatusId","kind":"json-schema","title":"ocsfv1.8.0ComplianceTest_AssessmentStatusId","data":{"title":"ocsfv1.8.0ComplianceTest_AssessmentStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ComplianceTestAssessmentStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The assessment result is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Pass: The control or test passed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Warning: The assessment did not yield a definitive result."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Fail: The control or test failed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - NotAssessed: The control or test has not been assessed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - NotApplicable: The control or test is not applicable."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The assessment status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"assessment_status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Container":{"id":"components/schemas/ocsfv1.8.0Container","kind":"json-schema","title":"ocsfv1.8.0Container","data":{"title":"ocsfv1.8.0Container","type":"object","description":"The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.","properties":{"hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Commit hash of image created for docker or the SHA256 hash of the container. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"image":{"$ref":"#/components/schemas/ocsfv1.8.0Image","nullable":true,"description":"The container image used as a template to run the container."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels associated to the container."},"name":{"type":"string","nullable":true,"description":"The container name."},"network_driver":{"type":"string","nullable":true,"description":"The network driver used by the container. For example, bridge, overlay, host, none, etc."},"orchestrator":{"type":"string","nullable":true,"description":"The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift."},"pod_uuid":{"type":"string","nullable":true,"description":"The unique identifier of the pod (or equivalent) that the container is executing on."},"runtime":{"type":"string","nullable":true,"description":"The backend running the container, such as containerd or cri-o."},"size":{"type":"integer","nullable":true,"description":"The size of the container image."},"tag":{"type":"string","nullable":true,"description":"The tag used by the container. It can indicate version, format, OS."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the container."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full container unique identifier for this instantiation of the container. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0Conversation":{"id":"components/schemas/ocsfv1.8.0Conversation","kind":"json-schema","title":"ocsfv1.8.0Conversation","data":{"title":"ocsfv1.8.0Conversation","type":"object","description":"A conversation in an enterprise chat platform, such as a channel, direct message, group chat, or AI assistant session.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the conversation was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the conversation was created."},"last_activity_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the most recent message in the conversation."},"last_activity_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the most recent message in the conversation."},"member_count":{"type":"integer","nullable":true,"description":"The number of members in the conversation."},"name":{"type":"string","nullable":true,"description":"The display name of the conversation (e.g. channel name, chat topic)."},"platform":{"type":"string","nullable":true,"description":"The platform or application hosting this conversation, e.g. teams, copilot, slack."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The conversation type, normalized to the caption of type_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Conversation_TypeId","nullable":true,"description":"The normalized conversation type identifier."},"uid":{"type":"string","description":"The unique identifier of the conversation."}},"required":["uid"]}},"components/schemas/ocsfv1.8.0Conversation_TypeId":{"id":"components/schemas/ocsfv1.8.0Conversation_TypeId","kind":"json-schema","title":"ocsfv1.8.0Conversation_TypeId","data":{"title":"ocsfv1.8.0Conversation_TypeId","type":"integer","description":"ConversationTypeId is an enum, and the following values are allowed.\n0 - Unknown: The type is unknown.\n1 - Channel: A team-based group conversation, e.g. a Teams channel or Slack channel.\n2 - DirectMessage: A 1:1 private conversation between two users.\n3 - GroupChat: A group conversation among more than two users, without a team scope.\n4 - AISession: An AI assistant session, e.g. a Microsoft 365 Copilot interaction history.\n99 - Other: The conversation type is not mapped. See the type attribute for the data source specific value."}},"components/schemas/ocsfv1.8.0Cve":{"id":"components/schemas/ocsfv1.8.0Cve","kind":"json-schema","title":"ocsfv1.8.0Cve","data":{"title":"ocsfv1.8.0Cve","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Vulnerabilities and Exposures (CVE) object represents publicly disclosed cybersecurity vulnerabilities defined in CVE Program catalog ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cve.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVE"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"). There is one CVE Record for each vulnerability in the catalog."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE."},"cvss":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Cvss"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS object details Common Vulnerability Scoring System ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/cvss/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") scores from the advisory that are related to the vulnerability."},"children":[],"type":"text"}],"type":"paragraph"}]},"cwe":{"$ref":"#/components/schemas/ocsfv1.8.0Cwe","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CWE object represents a weakness in a software system that can be exploited by a threat actor to perform an attack. The CWE object is based on the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Common Weakness Enumeration (CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" catalog."},"children":[],"type":"text"}],"type":"paragraph"}]},"cwe_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Common Weakness Enumeration (CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" unique identifier. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CWE-787"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cwe_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Common Weakness Enumeration (CWE) definition URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://cwe.mitre.org/data/definitions/787.html"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"desc":{"type":"string","nullable":true,"description":"A brief description of the CVE Record."},"epss":{"$ref":"#/components/schemas/ocsfv1.8.0Epss","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Exploit Prediction Scoring System (EPSS) object describes the estimated probability a vulnerability will be exploited. EPSS is a community-driven effort to combine descriptive information about vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild. ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/epss/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"EPSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}]},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The Record Modified Date identifies when the CVE record was last updated."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The Record Modified Date identifies when the CVE record was last updated."},"product":{"$ref":"#/components/schemas/ocsfv1.8.0Product","nullable":true,"description":"The product where the vulnerability was discovered."},"references":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of reference URLs with additional information about the CVE Record."},"related_cwes":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Cwe"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the Common Weakness Enumeration "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"(CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" details related to the CVE Record."},"children":[],"type":"text"}],"type":"paragraph"}]},"title":{"type":"string","nullable":true,"description":"A title or a brief phrase summarizing the CVE record."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The vulnerability type as selected from a large dropdown menu during CVE refinement."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"Most frequently used vulnerability types are: "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"DoS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Code Execution"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Overflow"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Memory Corruption"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Sql Injection"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"XSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Directory Traversal"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Http Response Splitting"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Bypass something"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Gain Information"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Gain Privileges"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"CSRF"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"File Inclusion"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":". For more information see "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.cvedetails.com/vulnerabilities-by-types.php"}},"children":[{"$$mdtype":"Node","attributes":{"content":"Vulnerabilities By Type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" distributions."},"children":[],"type":"text"}]},"uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Vulnerabilities and Exposures unique number assigned to a specific computer vulnerability. A CVE Identifier begins with 4 digits representing the year followed by a sequence of digits that acts as a unique identifier. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVE-2021-12345"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["uid"]}},"components/schemas/ocsfv1.8.0Cvss":{"id":"components/schemas/ocsfv1.8.0Cvss","kind":"json-schema","title":"ocsfv1.8.0Cvss","data":{"title":"ocsfv1.8.0Cvss","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Vulnerability Scoring System ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/cvss/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") object provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"base_score":{"type":"number","format":"double","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS base score. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"9.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"depth":{"$ref":"#/components/schemas/ocsfv1.8.0Cvss_Depth","nullable":true,"description":"The CVSS depth represents a depth of the equation used to calculate CVSS score."},"metrics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Metric"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Vulnerability Scoring System metrics. This attribute contains information on the CVE's impact. If the CVE has been analyzed, this attribute will contain any CVSSv2 or CVSSv3 information associated with the vulnerability. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{ {\"Access Vector\", \"Network\"}, {\"Access Complexity\", \"Low\"}, ...}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"overall_score":{"type":"number","format":"double","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS overall score, impacted by base, temporal, and environmental metrics. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"9.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"CVSS v2.0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Low (0.0 – 3.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Medium (4.0 – 6.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"High (7.0 – 10.0)"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"CVSS v3.0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"None (0.0)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Low (0.1 - 3.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Medium (4.0 - 6.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"High (7.0 - 8.9)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Critical (9.0 - 10.0)"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The source URL for the CVSS score. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"vector_string":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"vendor_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The vendor that provided the CVSS score. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NVD, REDHAT"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" etc."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"3.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["base_score","version"]}},"components/schemas/ocsfv1.8.0Cvss_Depth":{"id":"components/schemas/ocsfv1.8.0Cvss_Depth","kind":"json-schema","title":"ocsfv1.8.0Cvss_Depth","data":{"title":"ocsfv1.8.0Cvss_Depth","type":"string","description":"CvssDepth is an enum, and the following values are allowed.\nBase - Base\nEnvironmental - Environmental\nTemporal - Temporal"}},"components/schemas/ocsfv1.8.0Cwe":{"id":"components/schemas/ocsfv1.8.0Cwe","kind":"json-schema","title":"ocsfv1.8.0Cwe","data":{"title":"ocsfv1.8.0Cwe","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CWE object represents a weakness in a software system that can be exploited by a threat actor to perform an attack. The CWE object is based on the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Common Weakness Enumeration (CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" catalog."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"caption":{"type":"string","nullable":true,"description":"The caption assigned to the Common Weakness Enumeration unique identifier."},"src_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"URL pointing to the CWE Specification. For more information see "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CWE."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Weakness Enumeration unique number assigned to a specific weakness. A CWE Identifier begins \"CWE\" followed by a sequence of digits that acts as a unique identifier. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CWE-123"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["uid"]}},"components/schemas/ocsfv1.8.0D3fTactic":{"id":"components/schemas/ocsfv1.8.0D3fTactic","kind":"json-schema","title":"ocsfv1.8.0D3fTactic","data":{"title":"ocsfv1.8.0D3fTactic","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE D3FEND™ Tactic object describes the tactic ID and/or name that is associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The tactic name that is associated with the defensive technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Isolate"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The versioned permalink of the defensive tactic. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://d3fend.mitre.org/tactic/d3f:Isolate/"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the defensive tactic."}}}},"components/schemas/ocsfv1.8.0D3fTechnique":{"id":"components/schemas/ocsfv1.8.0D3fTechnique","kind":"json-schema","title":"ocsfv1.8.0D3fTechnique","data":{"title":"ocsfv1.8.0D3fTechnique","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE D3FEND™ Technique object describes the leaf defensive technique ID and/or name associated to a countermeasure."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the defensive technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IO Port Restriction"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The versioned permalink of the defensive technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://d3fend.mitre.org/technique/d3f:IOPortRestriction/"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the defensive technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"D3-IOPR"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0D3fend":{"id":"components/schemas/ocsfv1.8.0D3fend","kind":"json-schema","title":"ocsfv1.8.0D3fend","data":{"title":"ocsfv1.8.0D3fend","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE D3FEND™ object describes the tactic & technique associated with a countermeasure."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"d3f_tactic":{"$ref":"#/components/schemas/ocsfv1.8.0D3fTactic","nullable":true,"description":"The Tactic object describes the tactic ID and/or name that is associated with a countermeasure."},"d3f_technique":{"$ref":"#/components/schemas/ocsfv1.8.0D3fTechnique","nullable":true,"description":"The Technique object describes the technique ID and/or name associated with a countermeasure."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The D3FEND™ Matrix version."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0Database":{"id":"components/schemas/ocsfv1.8.0Database","kind":"json-schema","title":"ocsfv1.8.0Database","data":{"title":"ocsfv1.8.0Database","type":"object","description":"The database object is used for databases which are typically datastore services that contain an organized collection of structured and unstructured data or a types of data.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the database was known to have been created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the database was known to have been created."},"desc":{"type":"string","nullable":true,"description":"The description of the database."},"embedding_model":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Model used for creating embeddings (if applicable). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"text-embedding-ada-002"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"all-MiniLM-L6-v2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Group"},"nullable":true,"description":"The group names to which the database belongs."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The most recent time when any changes, updates, or modifications were made within the database."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent time when any changes, updates, or modifications were made within the database."},"name":{"type":"string","nullable":true,"description":"The database name, ordinarily as assigned by a database administrator."},"size":{"type":"integer","nullable":true,"description":"The size of the database in bytes."},"type":{"type":"string","nullable":true,"description":"The database type."},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Database_TypeId","description":"The normalized identifier of the database type."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the database."}},"required":["type_id"]}},"components/schemas/ocsfv1.8.0Database_TypeId":{"id":"components/schemas/ocsfv1.8.0Database_TypeId","kind":"json-schema","title":"ocsfv1.8.0Database_TypeId","data":{"title":"ocsfv1.8.0Database_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DatabaseTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Relational"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Network"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - ObjectOriented"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Centralized"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Operational"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - NoSQL"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Vector"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - KnowledgeGraph"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Databucket":{"id":"components/schemas/ocsfv1.8.0Databucket","kind":"json-schema","title":"ocsfv1.8.0Databucket","data":{"title":"ocsfv1.8.0Databucket","type":"object","description":"The databucket object is a basic container that holds data, typically organized through the use of data partitions.","properties":{"agent_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Agent"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"agent"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects associated with a device, endpoint, or resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"cloud_partition":{"type":"string","nullable":true,"description":"The logical grouping or isolated segment within a cloud provider's infrastructure where the databucket is located."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the databucket was known to have been created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the databucket was known to have been created."},"criticality":{"type":"string","nullable":true,"description":"The criticality of the databucket as defined by the event source."},"data":{"nullable":true,"description":"Additional data describing the resource."},"desc":{"type":"string","nullable":true,"description":"The description of the databucket."},"encryption_details":{"$ref":"#/components/schemas/ocsfv1.8.0EncryptionDetails","nullable":true,"description":"The encryption details of the databucket. Should be populated if the databucket is encrypted."},"file":{"$ref":"#/components/schemas/ocsfv1.8.0File","nullable":true,"description":"Details about the file/object within a databucket."},"group":{"$ref":"#/components/schemas/ocsfv1.8.0Group","nullable":true,"description":"The name of the related resource group."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Group"},"nullable":true,"description":"The group names to which the databucket belongs."},"hostname":{"$ref":"#/components/schemas/ocsfv1.8.0Hostname","nullable":true,"description":"The fully qualified hostname of the databucket."},"ip":{"$ref":"#/components/schemas/ocsfv1.8.0IPAddress","nullable":true,"description":"The IP address of the resource, in either IPv4 or IPv6 format."},"is_backed_up":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates whether the device or resource has a backup enabled, such as an automated snapshot or a cloud backup. For example, this is indicated by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cloudBackupEnabled"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value within JAMF Pro mobile devices or the registration of an AWS ARN with the AWS Backup service."},"children":[],"type":"text"}],"type":"paragraph"}]},"is_encrypted":{"type":"boolean","nullable":true,"description":"Indicates if the databucket is encrypted."},"is_public":{"type":"boolean","nullable":true,"description":"Indicates if the databucket is publicly accessible."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels associated to the resource."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The most recent time when any changes, updates, or modifications were made within the databucket."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent time when any changes, updates, or modifications were made within the databucket."},"name":{"type":"string","nullable":true,"description":"The databucket name."},"namespace":{"type":"string","nullable":true,"description":"The namespace is useful when similar entities exist that you need to keep separate."},"owner":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The identity of the service or user account that owns the databucket."},"region":{"type":"string","nullable":true,"description":"The cloud region of the databucket."},"resource_relationship":{"$ref":"#/components/schemas/ocsfv1.8.0Graph","nullable":true,"description":"A graph representation showing how this databucket relates to and interacts with other entities in the environment. This can include parent/child relationships, dependencies, or other connections."},"size":{"type":"integer","nullable":true,"description":"The size of the databucket in bytes."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":"The databucket type."},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Databucket_TypeId","description":"The normalized identifier of the databucket type."},"uid":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceUID","nullable":true,"description":"The unique identifier of the databucket."},"uid_alt":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceUID","nullable":true,"description":"The alternative unique identifier of the resource."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The version of the resource. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.2.3"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"zone":{"type":"string","nullable":true,"description":"The specific availability zone within a cloud region where the databucket is located."}},"required":["type_id"]}},"components/schemas/ocsfv1.8.0Databucket_TypeId":{"id":"components/schemas/ocsfv1.8.0Databucket_TypeId","kind":"json-schema","title":"ocsfv1.8.0Databucket_TypeId","data":{"title":"ocsfv1.8.0Databucket_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DatabucketTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - S3"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - AzureBlob"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - GCPBucket"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Device":{"id":"components/schemas/ocsfv1.8.0Device","kind":"json-schema","title":"ocsfv1.8.0Device","data":{"title":"ocsfv1.8.0Device","type":"object","description":"The Device object represents an addressable computer system or host, which is typically connected to a computer network and participates in the transmission or processing of data within the computer network.","properties":{"agent_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Agent"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"agent"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects associated with a device, endpoint, or resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"autoscale_uid":{"type":"string","nullable":true,"description":"The unique identifier of the cloud autoscale configuration."},"boot_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the system was booted."},"boot_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the system was booted."},"boot_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A unique identifier of the device that changes after every reboot. For example, the value of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"/proc/sys/kernel/random/boot_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from Linux's procfs."},"children":[],"type":"text"}],"type":"paragraph"}]},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the device was known to have been created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the device was known to have been created."},"desc":{"type":"string","nullable":true,"description":"The description of the device, ordinarily as reported by the operating system."},"domain":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network domain where the device resides. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"work.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"eid":{"type":"string","nullable":true,"description":"An Embedded Identity Document, is a unique serial number that identifies an eSIM-enabled device."},"first_seen_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The initial discovery time of the device."},"first_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The initial discovery time of the device."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Group"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The group names to which the device belongs. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[\"Windows Laptops\", \"Engineering\"]"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"hostname":{"$ref":"#/components/schemas/ocsfv1.8.0Hostname","nullable":true,"description":"The device hostname."},"hw_info":{"$ref":"#/components/schemas/ocsfv1.8.0DeviceHwInfo","nullable":true,"description":"The endpoint hardware information."},"hypervisor":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the hypervisor running on the device. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Xen"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"VMware"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Hyper-V"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"VirtualBox"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", etc."},"children":[],"type":"text"}],"type":"paragraph"}]},"iccid":{"type":"string","nullable":true,"description":"The Integrated Circuit Card Identification of a mobile device. Typically it is a unique 18 to 22 digit number that identifies a SIM card."},"image":{"$ref":"#/components/schemas/ocsfv1.8.0Image","nullable":true,"description":"The image used as a template to run the virtual machine."},"imei":{"type":"string","nullable":true,"description":"The International Mobile Equipment Identity that is associated with the device."},"imei_list":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The International Mobile Equipment Identity values that are associated with the device."},"instance_uid":{"type":"string","nullable":true,"description":"The unique identifier of a VM instance."},"interface_name":{"type":"string","nullable":true,"description":"The name of the network interface (e.g. eth2)."},"interface_uid":{"type":"string","nullable":true,"description":"The unique identifier of the network interface."},"ip":{"$ref":"#/components/schemas/ocsfv1.8.0IPAddress","nullable":true,"description":"The device IP address, in either IPv4 or IPv6 format."},"is_backed_up":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates whether the device or resource has a backup enabled, such as an automated snapshot or a cloud backup. For example, this is indicated by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cloudBackupEnabled"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value within JAMF Pro mobile devices or the registration of an AWS ARN with the AWS Backup service."},"children":[],"type":"text"}],"type":"paragraph"}]},"is_compliant":{"type":"boolean","nullable":true,"description":"The event occurred on a compliant device."},"is_managed":{"type":"boolean","nullable":true,"description":"The event occurred on a managed device."},"is_mobile_account_active":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates whether the device has an active mobile account. For example, this is indicated by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"itunesStoreAccountActive"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value within JAMF Pro mobile devices."},"children":[],"type":"text"}],"type":"paragraph"}]},"is_personal":{"type":"boolean","nullable":true,"description":"The event occurred on a personal device."},"is_shared":{"type":"boolean","nullable":true,"description":"The event occurred on a shared device."},"is_supervised":{"type":"boolean","nullable":true,"description":"The event occurred on a supervised device. Devices that are supervised are typically mobile devices managed by a Mobile Device Management solution and are restricted from specific behaviors such as Apple AirDrop."},"is_trusted":{"type":"boolean","nullable":true,"description":"The event occurred on a trusted device."},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The most recent discovery time of the device."},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent discovery time of the device."},"location":{"$ref":"#/components/schemas/ocsfv1.8.0Location","nullable":true,"description":"The geographical location of the device."},"mac":{"$ref":"#/components/schemas/ocsfv1.8.0MACAddress","nullable":true,"description":"The Media Access Control (MAC) address of the endpoint."},"mac_vendor":{"type":"string","nullable":true,"description":"The vendor or manufacturer of the endpoint's network interface controller (NIC), as identified from the MAC address."},"meid":{"type":"string","nullable":true,"description":"The Mobile Equipment Identifier. It's a unique number that identifies a Code Division Multiple Access (CDMA) mobile device."},"model":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The model of the device. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ThinkPad X1 Carbon"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the device was last known to have been modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the device was last known to have been modified."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The alternate device name, ordinarily as assigned by an administrator. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" could be any other string that helps to identify the device, such as a phone number; for example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"310-555-1234"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"network_interfaces":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkInterface"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The physical or virtual network interfaces that are associated with the device, one for each unique MAC address/IP address/hostname/name combination."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" The first element of the array is the network information that pertains to the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"org":{"$ref":"#/components/schemas/ocsfv1.8.0Organization","nullable":true,"description":"Organization and org unit related to the device."},"os":{"$ref":"#/components/schemas/ocsfv1.8.0Os","nullable":true,"description":"The endpoint operating system."},"os_machine_uuid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The operating system assigned Machine ID. In Windows, this is the value stored at the registry path: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\MachineGuid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In Linux, this is stored in the file: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"/etc/machine-id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"owner":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The identity of the service or user account that owns the endpoint or was last logged into it."},"pool":{"$ref":"#/components/schemas/ocsfv1.8.0Group","nullable":true,"description":"The pool of desktops or virtual machines to which the endpoint belongs."},"region":{"type":"string","nullable":true,"description":"The region where the virtual machine is located. For example, an AWS Region."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0Device_RiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"src_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":"The URL of the device in the event sources system."},"subnet":{"$ref":"#/components/schemas/ocsfv1.8.0Subnet","nullable":true,"description":"The subnet mask."},"subnet_uid":{"type":"string","nullable":true,"description":"The unique identifier of a virtual subnet."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The device type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"unknown"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Device_TypeId","description":"The device type ID."},"udid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Apple assigned Unique Device Identifier (UDID). For iOS, iPadOS, tvOS, watchOS and visionOS devices, this is the UDID. For macOS devices, it is the Provisioning UDID. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"00008020-008D4548007B4F26"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the device. For example the Windows TargetSID or AWS EC2 ARN."},"uid_alt":{"type":"string","nullable":true,"description":"An alternate unique identifier of the device if any. For example the ActiveDirectory DN."},"vendor_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The vendor for the device. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Dell"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Lenovo"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"vlan_uid":{"type":"string","nullable":true,"description":"The Virtual LAN identifier."},"vpc_uid":{"type":"string","nullable":true,"description":"The unique identifier of the Virtual Private Cloud (VPC)."},"zone":{"type":"string","nullable":true,"description":"The network zone or LAN segment."}},"required":["type_id"]}},"components/schemas/ocsfv1.8.0Device_RiskLevelId":{"id":"components/schemas/ocsfv1.8.0Device_RiskLevelId","kind":"json-schema","title":"ocsfv1.8.0Device_RiskLevelId","data":{"title":"ocsfv1.8.0Device_RiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DeviceRiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Device_TypeId":{"id":"components/schemas/ocsfv1.8.0Device_TypeId","kind":"json-schema","title":"ocsfv1.8.0Device_TypeId","data":{"title":"ocsfv1.8.0Device_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DeviceTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Server: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Server/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Desktop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Laptop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Tablet: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Mobile: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile phone"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Virtual: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual machine"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - IOT: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.techtarget.com/iotagenda/definition/IoT-device"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IOT (Internet of Things) device"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Browser: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Browser/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"web browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Firewall: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Firewall/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking firewall"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Switch: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Switch/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking switch"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Hub: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Ethernet_hub"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking hub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - Router: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Router/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking router"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - IDS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion detection system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - IPS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion prevention system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - LoadBalancer: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Load_balancing_(computing)"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Load Balancer device."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0DeviceHwInfo":{"id":"components/schemas/ocsfv1.8.0DeviceHwInfo","kind":"json-schema","title":"ocsfv1.8.0DeviceHwInfo","data":{"title":"ocsfv1.8.0DeviceHwInfo","type":"object","description":"The Device Hardware Information object contains details and specifications of the physical components that make up a device. This information provides an overview of the hardware capabilities, configuration, and characteristics of the device.","properties":{"bios_date":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The BIOS date. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"03/31/16"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"bios_manufacturer":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The BIOS manufacturer. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LENOVO"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"bios_ver":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The BIOS version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LENOVO G5ETA2WW (2.62)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"chassis":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The chassis type describes the system enclosure or physical form factor. Such as the following examples for Windows "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Windows Chassis Types"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"cpu_architecture":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CPU architecture, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpu_architecture_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_architecture_id":{"$ref":"#/components/schemas/ocsfv1.8.0DeviceHwInfo_CpuArchitectureId","nullable":true,"description":"The normalized identifier of the CPU architecture."},"cpu_bits":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cpu architecture, the number of bits used for addressing in memory. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"32"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"64"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_cores":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of processor cores in all installed processors. For Example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"42"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of physical processors on a system. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_speed":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The speed of the processor in Mhz. For Example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"4200"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The processor type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"x86 Family 6 Model 37 Stepping 5"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"desktop_display":{"$ref":"#/components/schemas/ocsfv1.8.0Display","nullable":true,"description":"The desktop display affiliated with the event"},"gpu_count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of GPU's on a system. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"gpu_info_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0GpuInfo"},"nullable":true,"description":"A list of GPU objects describing the hardware properties of each graphics processor installed on the device."},"keyboard_info":{"$ref":"#/components/schemas/ocsfv1.8.0KeyboardInfo","nullable":true,"description":"The keyboard detailed information."},"ram_size":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The total amount of installed RAM, in Megabytes. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2048"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"serial_number":{"type":"string","nullable":true,"description":"The device manufacturer serial number."},"uuid":{"type":"string","nullable":true,"description":"The device manufacturer assigned universally unique hardware identifier. For SMBIOS compatible devices such as those running Linux and Windows, it is the UUID member of the System Information structure in the SMBIOS information. For macOS devices, it is the Hardware UUID (also known as IOPlatformUUID in the I/O Registry)."},"vendor_name":{"type":"string","nullable":true,"description":"The device manufacturer."}}}},"components/schemas/ocsfv1.8.0DeviceHwInfo_CpuArchitectureId":{"id":"components/schemas/ocsfv1.8.0DeviceHwInfo_CpuArchitectureId","kind":"json-schema","title":"ocsfv1.8.0DeviceHwInfo_CpuArchitectureId","data":{"title":"ocsfv1.8.0DeviceHwInfo_CpuArchitectureId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DeviceHwInfoCpuArchitectureId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The CPU architecture is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - x86: CPU uses the x86 ISA. For bitness, refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpu_bits"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - ARM: CPU uses the ARM ISA. For bitness, refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpu_bits"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - V: CPU uses the RISC-V ISA. For bitness, refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpu_bits"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The CPU architecture is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpu_architecture"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0DigitalSignature":{"id":"components/schemas/ocsfv1.8.0DigitalSignature","kind":"json-schema","title":"ocsfv1.8.0DigitalSignature","data":{"title":"ocsfv1.8.0DigitalSignature","type":"object","description":"The Digital Signature object contains information about the cryptographic mechanism used to verify the authenticity, integrity, and origin of the file or application.","properties":{"algorithm":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The digital signature algorithm used to create the signature, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"algorithm_id":{"$ref":"#/components/schemas/ocsfv1.8.0DigitalSignature_AlgorithmId","description":"The identifier of the normalized digital signature algorithm."},"certificate":{"$ref":"#/components/schemas/ocsfv1.8.0Certificate","nullable":true,"description":"The certificate object containing information about the digital certificate."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the digital signature was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the digital signature was created."},"developer_uid":{"type":"string","nullable":true,"description":"The developer ID on the certificate that signed the file."},"digest":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":"The message digest attribute contains the fixed length message hash representation and the corresponding hashing algorithm information."},"state":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The digital signature state defines the signature state, normalized to the caption of 'state_id'. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"state_id":{"$ref":"#/components/schemas/ocsfv1.8.0DigitalSignature_StateId","nullable":true,"description":"The normalized identifier of the signature state."}},"required":["algorithm_id"]}},"components/schemas/ocsfv1.8.0DigitalSignature_AlgorithmId":{"id":"components/schemas/ocsfv1.8.0DigitalSignature_AlgorithmId","kind":"json-schema","title":"ocsfv1.8.0DigitalSignature_AlgorithmId","data":{"title":"ocsfv1.8.0DigitalSignature_AlgorithmId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DigitalSignatureAlgorithmId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The algorithm is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - DSA: Digital Signature Algorithm (DSA)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - ECDSA: Elliptic Curve Digital Signature Algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The algorithm is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"algorithm"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0DigitalSignature_StateId":{"id":"components/schemas/ocsfv1.8.0DigitalSignature_StateId","kind":"json-schema","title":"ocsfv1.8.0DigitalSignature_StateId","data":{"title":"ocsfv1.8.0DigitalSignature_StateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DigitalSignatureStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Valid: The digital signature is valid."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Expired: The digital signature is invalid because its timestamp does not fall within the certificate's validity period."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Revoked: The digital signature is invalid due to certificate revocation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Suspended: The digital signature is invalid due to certificate suspension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Pending: The digital signature state is pending."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Untrusted: The digital signature is invalid because the certificate is rooted in an untrusted CA or is an untrusted self-signed certificate."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Distrusted: The digital signature is invalid because the certificate is explicitly distrusted. Note that whereas revocation is global, distrust reflects local IT/security policy."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - WrongUsage: The digital signature is invalid because the certificate is not intended for code signing purposes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Bad: The digital signature is cryptographically invalid, e.g. a mismatched digest. This indicates possible tampering."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Broken: The digital signature is malformed and could not be processed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Display":{"id":"components/schemas/ocsfv1.8.0Display","kind":"json-schema","title":"ocsfv1.8.0Display","data":{"title":"ocsfv1.8.0Display","type":"object","description":"The Display object contains information about the physical or virtual display connected to a computer system.","properties":{"color_depth":{"type":"integer","nullable":true,"description":"The numeric color depth."},"physical_height":{"type":"integer","nullable":true,"description":"The numeric physical height of display."},"physical_orientation":{"type":"integer","nullable":true,"description":"The numeric physical orientation of display."},"physical_width":{"type":"integer","nullable":true,"description":"The numeric physical width of display."},"scale_factor":{"type":"integer","nullable":true,"description":"The numeric scale factor of display."}}}},"components/schemas/ocsfv1.8.0DnsAnswer":{"id":"components/schemas/ocsfv1.8.0DnsAnswer","kind":"json-schema","title":"ocsfv1.8.0DnsAnswer","data":{"title":"ocsfv1.8.0DnsAnswer","type":"object","description":"The DNS Answer object represents a specific response provided by the Domain Name System (DNS) when querying for information about a domain or performing a DNS operation. It encapsulates the relevant details and data returned by the DNS server in response to a query.","properties":{"class":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The class of DNS data contained in this resource record. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.rfc-editor.org/rfc/rfc1035.txt"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC1035"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IN"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"flag_ids":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0DnsAnswer_FlagIds"},"nullable":true,"description":"The list of DNS answer header flag IDs."},"flags":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of DNS answer header flags."},"packet_uid":{"type":"integer","nullable":true,"description":"The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response."},"rdata":{"type":"string","description":"The data describing the DNS resource. The meaning of this data depends on the type and class of the resource record."},"ttl":{"type":"integer","nullable":true,"description":"The time interval that the resource record may be cached. Zero value means that the resource record can only be used for the transaction in progress, and should not be cached."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of data contained in this resource record. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.rfc-editor.org/rfc/rfc1035.txt"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC1035"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CNAME"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["rdata"]}},"components/schemas/ocsfv1.8.0DnsAnswer_FlagIds":{"id":"components/schemas/ocsfv1.8.0DnsAnswer_FlagIds","kind":"json-schema","title":"ocsfv1.8.0DnsAnswer_FlagIds","data":{"title":"ocsfv1.8.0DnsAnswer_FlagIds","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DnsAnswerFlagIds is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The flag is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - AuthoritativeAnswer"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - TruncatedResponse"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - RecursionDesired"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - RecursionAvailable"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - AuthenticData"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - CheckingDisabled"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The flag is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"flags"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0DnsQuery":{"id":"components/schemas/ocsfv1.8.0DnsQuery","kind":"json-schema","title":"ocsfv1.8.0DnsQuery","data":{"title":"ocsfv1.8.0DnsQuery","type":"object","description":"The DNS query object represents a specific request made to the Domain Name System (DNS) to retrieve information about a domain or perform a DNS operation. This object encapsulates the necessary attributes and methods to construct and send DNS queries, specify the query type (e.g., A, AAAA, MX).","properties":{"class":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The class of resource records being queried. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.rfc-editor.org/rfc/rfc1035.txt"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC1035"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IN"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"hostname":{"$ref":"#/components/schemas/ocsfv1.8.0Hostname","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hostname or domain being queried. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"www.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"opcode":{"type":"string","nullable":true,"description":"The DNS opcode specifies the type of the query message."},"opcode_id":{"$ref":"#/components/schemas/ocsfv1.8.0DnsQuery_OpcodeId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The DNS opcode ID specifies the normalized query message type as defined in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.rfc-editor.org/rfc/rfc5395.html"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-5395"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"packet_uid":{"type":"integer","nullable":true,"description":"The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of resource records being queried. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.rfc-editor.org/rfc/rfc1035.txt"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC1035"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: A, AAAA, CNAME, MX, and NS."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["hostname"]}},"components/schemas/ocsfv1.8.0DnsQuery_OpcodeId":{"id":"components/schemas/ocsfv1.8.0DnsQuery_OpcodeId","kind":"json-schema","title":"ocsfv1.8.0DnsQuery_OpcodeId","data":{"title":"ocsfv1.8.0DnsQuery_OpcodeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DnsQueryOpcodeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Query: Standard query"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - InverseQuery: Inverse query, obsolete"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Status: Server status request"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Reserved: Reserved, not used"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Notify: Zone change notification"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Update: Dynamic DNS update"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - DSOMessage: DNS Stateful Operations (DSO)"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The DNS Opcode is not defined by the RFC. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"opcode"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0DomainContact":{"id":"components/schemas/ocsfv1.8.0DomainContact","kind":"json-schema","title":"ocsfv1.8.0DomainContact","data":{"title":"ocsfv1.8.0DomainContact","type":"object","description":"The contact information related to a domain registration, e.g., registrant, administrator, abuse, billing, or technical contact.","properties":{"email_addr":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress","nullable":true,"description":"The user's primary email address."},"location":{"$ref":"#/components/schemas/ocsfv1.8.0Location","nullable":true,"description":"Location details for the contract such as the city, state/province, country, etc."},"name":{"type":"string","nullable":true,"description":"The individual or organization name for the contact."},"phone_number":{"type":"string","nullable":true,"description":"The number associated with the phone."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Domain Contact type, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source"},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0DomainContact_TypeId","description":"The normalized domain contact type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the contact information, typically provided in WHOIS information."}},"required":["type_id"]}},"components/schemas/ocsfv1.8.0DomainContact_TypeId":{"id":"components/schemas/ocsfv1.8.0DomainContact_TypeId","kind":"json-schema","title":"ocsfv1.8.0DomainContact_TypeId","data":{"title":"ocsfv1.8.0DomainContact_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DomainContactTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Registrant: The contact information provided is for the domain registrant."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Administrative: The contact information provided is for the domain administrator."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Technical: The contact information provided is for the domain technical lead."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Billing: The contact information provided is for the domain billing lead."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Abuse: The contact information provided is for the domain abuse contact."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Edge":{"id":"components/schemas/ocsfv1.8.0Edge","kind":"json-schema","title":"ocsfv1.8.0Edge","data":{"title":"ocsfv1.8.0Edge","type":"object","description":"Represents a connection or relationship between two nodes in a graph.","properties":{"data":{"nullable":true,"description":"Additional data about the edge such as weight, distance, or custom properties."},"is_directed":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates whether the edge is ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") or undirected ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","nullable":true,"description":"The human-readable name or label for the edge."},"relation":{"type":"string","nullable":true,"description":"The type of relationship between nodes (e.g. is-attached-to , depends-on, etc)."},"source":{"type":"string","description":"The unique identifier of the node where the edge originates."},"target":{"type":"string","description":"The unique identifier of the node where the edge terminates."},"uid":{"type":"string","nullable":true,"description":"Unique identifier of the edge."}},"required":["source","target"]}},"components/schemas/ocsfv1.8.0Email":{"id":"components/schemas/ocsfv1.8.0Email","kind":"json-schema","title":"ocsfv1.8.0Email","data":{"title":"ocsfv1.8.0Email","type":"object","description":"The Email object describes the email metadata such as sender, recipients, and direction, and can include embedded URLs and files.","properties":{"attachment_count":{"type":"integer","nullable":true,"description":"The number of attachments in the email as reported by the event source."},"bcc":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable email header Bcc values, as defined by RFC 5322. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"bcc_mailboxes":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-readable email header Bcc Mailbox values. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"'Example User <example.user@usersdomain.com>'"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cc":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable email header Cc values, as defined by RFC 5322. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cc_mailboxes":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-readable email header Cc Mailbox values. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"'Example User <example.user@usersdomain.com>'"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"delivered_to":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Delivered-To"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" email header field. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"delivered_to_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Delivered-To"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" email header values. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"files":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0File"},"nullable":true,"description":"The files embedded or attached to the email."},"from":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable email header From value, as defined by RFC 5322. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"from_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable email header From values. This array should contain the value in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"from"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"from_mailbox":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-readable email header From Mailbox value. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"'Example User <example.user@usersdomain.com>'"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"from_mailboxes":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-readable email header From Mailbox values. This array should contain the value in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"from_mailbox"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"'Example User <example.user@usersdomain.com>'"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"http_headers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0HttpHeader"},"nullable":true,"description":"Additional HTTP headers of an HTTP request or response."},"is_delivered":{"type":"boolean","nullable":true,"description":"The indication of whether the email was delivered to the recipient as reported by the event source."},"is_read":{"type":"boolean","nullable":true,"description":"The indication of whether the email has been read."},"message_uid":{"type":"string","nullable":true,"description":"The email header Message-ID value, as defined by RFC 5322."},"raw_header":{"type":"string","nullable":true,"description":"The email authentication header."},"reply_to":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable email header Reply-To value, as defined by RFC 5322. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"reply_to_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable email header Reply-To values, as defined by RFC 5322. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"reply_to_mailboxes":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-readable email header Reply To Mailbox values. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"'Example User <example.user@usersdomain.com>'"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"return_path":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The address found in the 'Return-Path' header, which indicates where bounce messages (non-delivery reports) should be sent. This address is often set by the sending system and may differ from the 'From' or 'Sender' addresses. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mailer-daemon@senderserver.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"sender":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine readable email address of the system or server that actually transmitted the email message, extracted from the email headers per RFC 5322. This differs from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"from"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field, which shows the message author. The sender field is most commonly used when multiple addresses appear in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" from_list "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field, or when the transmitting system is different from the message author (such as when sending on behalf of someone else)."},"children":[],"type":"text"}],"type":"paragraph"}]},"sender_mailbox":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human readable email address of the system or server that actually transmitted the email message, extracted from the email headers per RFC 5322. This differs from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"from_mailbox"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field, which shows the message author. The sender mailbox field is most commonly used when multiple addresses appear in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" from_mailboxes "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field, or when the transmitting system is different from the message author (such as when sending on behalf of someone else)."},"children":[],"type":"text"}],"type":"paragraph"}]},"size":{"type":"integer","nullable":true,"description":"The size in bytes of the email, including attachments."},"smtp_from":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress","nullable":true,"description":"The value of the SMTP MAIL FROM command."},"smtp_to":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress"},"nullable":true,"description":"The value of the SMTP envelope RCPT TO command."},"subject":{"type":"string","nullable":true,"description":"The email header Subject value, as defined by RFC 5322."},"to":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The machine-readable email header To values, as defined by RFC 5322. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.user@usersdomain.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"to_mailboxes":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-readable email header To Mailbox values. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"'Example User <example.user@usersdomain.com>'"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the email thread."},"url_count":{"type":"integer","nullable":true,"description":"The number of URLs embedded in the email as reported by the event source."},"urls":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Url"},"nullable":true,"description":"The URLs embedded in the email."},"x_originating_ip":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0IPAddress"},"nullable":true,"description":"The X-Originating-IP header identifying the emails originating IP address(es)."}}}},"components/schemas/ocsfv1.8.0EmailAuth":{"id":"components/schemas/ocsfv1.8.0EmailAuth","kind":"json-schema","title":"ocsfv1.8.0EmailAuth","data":{"title":"ocsfv1.8.0EmailAuth","type":"object","description":"The Email Authentication object describes the Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC) attributes of an email.","properties":{"dkim":{"type":"string","nullable":true,"description":"The DomainKeys Identified Mail (DKIM) status of the email."},"dkim_domain":{"type":"string","nullable":true,"description":"The DomainKeys Identified Mail (DKIM) signing domain of the email."},"dkim_signature":{"type":"string","nullable":true,"description":"The DomainKeys Identified Mail (DKIM) signature used by the sending/receiving system."},"dmarc":{"type":"string","nullable":true,"description":"The Domain-based Message Authentication, Reporting and Conformance (DMARC) status of the email."},"dmarc_override":{"type":"string","nullable":true,"description":"The Domain-based Message Authentication, Reporting and Conformance (DMARC) override action."},"dmarc_policy":{"type":"string","nullable":true,"description":"The Domain-based Message Authentication, Reporting and Conformance (DMARC) policy status."},"spf":{"type":"string","nullable":true,"description":"The Sender Policy Framework (SPF) status of the email."}}}},"components/schemas/ocsfv1.8.0EncryptionDetails":{"id":"components/schemas/ocsfv1.8.0EncryptionDetails","kind":"json-schema","title":"ocsfv1.8.0EncryptionDetails","data":{"title":"ocsfv1.8.0EncryptionDetails","type":"object","description":"Details about the encryption methodology utilized.","properties":{"algorithm":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The encryption algorithm used, normalized to the caption of 'algorithm_id"},"children":[],"type":"text"}],"type":"paragraph"}]},"algorithm_id":{"$ref":"#/components/schemas/ocsfv1.8.0EncryptionDetails_AlgorithmId","nullable":true,"description":"The encryption algorithm used."},"key_length":{"type":"integer","nullable":true,"description":"The length of the encryption key used."},"key_uid":{"type":"string","nullable":true,"description":"The unique identifier of the key used for encryption. For example, AWS KMS Key ARN."},"type":{"type":"string","nullable":true,"description":"The type of the encryption used."}}}},"components/schemas/ocsfv1.8.0EncryptionDetails_AlgorithmId":{"id":"components/schemas/ocsfv1.8.0EncryptionDetails_AlgorithmId","kind":"json-schema","title":"ocsfv1.8.0EncryptionDetails_AlgorithmId","data":{"title":"ocsfv1.8.0EncryptionDetails_AlgorithmId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"EncryptionDetailsAlgorithmId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The algorithm is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - DES: Data Encryption Standard Algorithm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - TripleDES: Triple Data Encryption Standard Algorithm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - AES: Advanced Encryption Standard Algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - RSA: Rivest-Shamir-Adleman Algorithm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - ECC: Elliptic Curve Cryptography Algorithm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - SM2: ShangMi Cryptographic Algorithm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The algorithm is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"algorithm"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Enrichment":{"id":"components/schemas/ocsfv1.8.0Enrichment","kind":"json-schema","title":"ocsfv1.8.0Enrichment","data":{"title":"ocsfv1.8.0Enrichment","type":"object","description":"The Enrichment object provides inline enrichment data for specific attributes of interest within an event. It serves as a mechanism to enhance or supplement the information associated with the event by adding additional relevant details or context.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the enrichment data was generated."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the enrichment data was generated."},"data":{"description":"The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record."},"desc":{"type":"string","nullable":true,"description":"A long description of the enrichment data."},"name":{"type":"string","description":"The name of the attribute to which the enriched data pertains."},"provider":{"type":"string","nullable":true,"description":"The enrichment data provider name."},"reputation":{"$ref":"#/components/schemas/ocsfv1.8.0Reputation","nullable":true,"description":"The reputation of the enrichment data."},"short_desc":{"type":"string","nullable":true,"description":"A short description of the enrichment data."},"src_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":"The URL of the source of the enrichment data."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The enrichment type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"location"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"value":{"type":"string","description":"The value of the attribute to which the enriched data pertains."}},"required":["data","name","value"]}},"components/schemas/ocsfv1.8.0Enrollment":{"id":"components/schemas/ocsfv1.8.0Enrollment","kind":"json-schema","title":"ocsfv1.8.0Enrollment","data":{"title":"ocsfv1.8.0Enrollment","type":"object","description":"An Enrollment is a record of a user's enrollment or assignment in a security awareness training campaign.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the enrollment was known to have been created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the enrollment was known to have been created."},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the enrollment is due at."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the enrollment is due at."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the enrollment was known to have been modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the enrollment was known to have been modified."},"name":{"type":"string","nullable":true,"description":"The name of the entity."},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the enrollment is scheduled to start or actually started."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the enrollment is scheduled to start or actually started."},"state":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The enrollment state, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"state_id":{"$ref":"#/components/schemas/ocsfv1.8.0Enrollment_StateId","nullable":true,"description":"The normalized identifier of the enrollment progress state."},"training_campaign_uid":{"type":"string","nullable":true,"description":"The training campaign that this enrollment is associated with. This attribute is only populated when the enrollment object is not nested within any level of a training campaign."},"type":{"type":"string","nullable":true,"description":"The enrollment type as reported by the source."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the entity."}}}},"components/schemas/ocsfv1.8.0Enrollment_StateId":{"id":"components/schemas/ocsfv1.8.0Enrollment_StateId","kind":"json-schema","title":"ocsfv1.8.0Enrollment_StateId","data":{"title":"ocsfv1.8.0Enrollment_StateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"EnrollmentStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Assigned: The enrollment is assigned but not started."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Started: The learner has started the enrollment."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Completed: The enrollment is completed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Overdue: The enrollment is overdue."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Expired: The enrollment has expired."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Waived: The enrollment was waived."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Failed: The learner failed a scored enrollment."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for the data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0EnvironmentVariable":{"id":"components/schemas/ocsfv1.8.0EnvironmentVariable","kind":"json-schema","title":"ocsfv1.8.0EnvironmentVariable","data":{"title":"ocsfv1.8.0EnvironmentVariable","type":"object","description":"An environment variable.","properties":{"name":{"type":"string","description":"The name of the environment variable."},"value":{"type":"string","description":"The value of the environment variable."}},"required":["name","value"]}},"components/schemas/ocsfv1.8.0Epss":{"id":"components/schemas/ocsfv1.8.0Epss","kind":"json-schema","title":"ocsfv1.8.0Epss","data":{"title":"ocsfv1.8.0Epss","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Exploit Prediction Scoring System (EPSS) object describes the estimated probability a vulnerability will be exploited. EPSS is a community-driven effort to combine descriptive information about vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild. ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/epss/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"EPSS"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The timestamp indicating when the EPSS score was calculated."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp indicating when the EPSS score was calculated."},"percentile":{"type":"number","format":"double","nullable":true,"description":"The EPSS score's percentile representing relative importance and ranking of the score in the larger EPSS dataset."},"score":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The EPSS score representing the probability [0-1] of exploitation in the wild in the next 30 days (following score publication)."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":"The version of the EPSS model used to calculate the score."}},"required":["score"]}},"components/schemas/ocsfv1.8.0Evidences":{"id":"components/schemas/ocsfv1.8.0Evidences","kind":"json-schema","title":"ocsfv1.8.0Evidences","data":{"title":"ocsfv1.8.0Evidences","type":"object","description":"A collection of evidence artifacts associated to the activity/activities that triggered a security detection.","properties":{"actor":{"$ref":"#/components/schemas/ocsfv1.8.0Actor","nullable":true,"description":"Describes details about the user/role/process that was the source of the activity that triggered the detection."},"api":{"$ref":"#/components/schemas/ocsfv1.8.0Api","nullable":true,"description":"Describes details about the API call associated to the activity that triggered the detection."},"connection_info":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkConnectionInfo","nullable":true,"description":"Describes details about the network connection associated to the activity that triggered the detection."},"container":{"$ref":"#/components/schemas/ocsfv1.8.0Container","nullable":true,"description":"Describes details about the container associated to the activity that triggered the detection."},"data":{"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Additional evidence data that is not accounted for in the specific evidence attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Use only when absolutely necessary."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"database":{"$ref":"#/components/schemas/ocsfv1.8.0Database","nullable":true,"description":"Describes details about the database associated to the activity that triggered the detection."},"databucket":{"$ref":"#/components/schemas/ocsfv1.8.0Databucket","nullable":true,"description":"Describes details about the databucket associated to the activity that triggered the detection."},"device":{"$ref":"#/components/schemas/ocsfv1.8.0Device","nullable":true,"description":"An addressable device, computer system or host associated to the activity that triggered the detection."},"dst_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint","nullable":true,"description":"Describes details about the destination of the network activity that triggered the detection."},"email":{"$ref":"#/components/schemas/ocsfv1.8.0Email","nullable":true,"description":"The email object associated to the activity that triggered the detection."},"file":{"$ref":"#/components/schemas/ocsfv1.8.0File","nullable":true,"description":"Describes details about the file associated to the activity that triggered the detection."},"http_request":{"$ref":"#/components/schemas/ocsfv1.8.0HttpRequest","nullable":true,"description":"Describes details about the http request associated to the activity that triggered the detection."},"http_response":{"$ref":"#/components/schemas/ocsfv1.8.0HttpResponse","nullable":true,"description":"Describes details about the http response associated to the activity that triggered the detection."},"ja4_fingerprint_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Ja4Fingerprint"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes details about the JA4+ fingerprints that triggered the detection."},"children":[],"type":"text"}],"type":"paragraph"}]},"job":{"$ref":"#/components/schemas/ocsfv1.8.0Job","nullable":true,"description":"Describes details about the scheduled job that was associated with the activity that triggered the detection."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The naming convention or type identifier of the evidence associated with the security detection. For example, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"@odata.type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from Microsoft Graph Alerts V2 or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"display_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from CrowdStrike Falcon Incident Behaviors."},"children":[],"type":"text"}],"type":"paragraph"}]},"process":{"$ref":"#/components/schemas/ocsfv1.8.0Process","nullable":true,"description":"Describes details about the process associated to the activity that triggered the detection."},"query":{"$ref":"#/components/schemas/ocsfv1.8.0DnsQuery","nullable":true,"description":"Describes details about the DNS query associated to the activity that triggered the detection."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes details about the cloud resources directly related to activity that triggered the detection. For resources impacted by the detection, use "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Affected Resources"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" at the top-level of the finding."},"children":[],"type":"text"}],"type":"paragraph"}]},"script":{"$ref":"#/components/schemas/ocsfv1.8.0Script","nullable":true,"description":"Describes details about the script that was associated with the activity that triggered the detection."},"src_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint","nullable":true,"description":"Describes details about the source of the network activity that triggered the detection."},"tls":{"$ref":"#/components/schemas/ocsfv1.8.0Tls","nullable":true,"description":"Describes details about the Transport Layer Security (TLS) activity that triggered the detection."},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the evidence associated with the security detection. For example, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from CrowdStrike Falcon Alerts or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"behavior_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from CrowdStrike Falcon Incident Behaviors."},"children":[],"type":"text"}],"type":"paragraph"}]},"url":{"$ref":"#/components/schemas/ocsfv1.8.0Url","nullable":true,"description":"The URL object that pertains to the event or object associated to the activity that triggered the detection."},"user":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"Describes details about the user that was the target or somehow else associated with the activity that triggered the detection."},"verdict":{"type":"string","nullable":true,"description":"The normalized verdict of the evidence associated with the security detection. "},"verdict_id":{"$ref":"#/components/schemas/ocsfv1.8.0Evidences_VerdictId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized verdict (or status) ID of the evidence associated with the security detection. For example, Microsoft Graph Security Alerts contain a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"verdict"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" enumeration for each type of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"evidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" associated with the Alert. This is typically set by an automated investigation process or an analyst/investigator assigned to the finding."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0Evidences_VerdictId":{"id":"components/schemas/ocsfv1.8.0Evidences_VerdictId","kind":"json-schema","title":"ocsfv1.8.0Evidences_VerdictId","data":{"title":"ocsfv1.8.0Evidences_VerdictId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"EvidencesVerdictId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - FalsePositive: The verdict for the evidence has been identified as a False Positive."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - TruePositive: The verdict for the evidence has been identified as a True Positive."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Disregard: The verdict for the evidence is that is should be Disregarded."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Suspicious: The verdict for the evidence is that the behavior has been identified as Suspicious."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Benign: The verdict for the evidence is that the behavior has been identified as Benign."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Test: The evidence is part of a Test, or other sanctioned behavior(s)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - InsufficientData: There is insufficient data to render a verdict on the evidence."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - SecurityRisk: The verdict for the evidence is that the behavior has been identified as a Security Risk."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - ManagedExternally: The verdict for the evidence is Managed Externally, such as in a case management tool."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Duplicate: This evidence duplicates existing evidence related to this finding."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0ExploitMaturityLevel":{"id":"components/schemas/ocsfv1.8.0ExploitMaturityLevel","kind":"json-schema","title":"ocsfv1.8.0ExploitMaturityLevel","data":{"title":"ocsfv1.8.0ExploitMaturityLevel","type":"object","description":"The maturity level object describes the CVSS maturity level of an exploit for a vulnerability.","properties":{"cvss_version":{"type":"string","nullable":true,"description":"The CVSS version used to assign the maturity level of the exploit."},"value":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CVSS maturity level of the exploit. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Not Defined"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Proof of Concept"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["value"]}},"components/schemas/ocsfv1.8.0Extension":{"id":"components/schemas/ocsfv1.8.0Extension","kind":"json-schema","title":"ocsfv1.8.0Extension","data":{"title":"ocsfv1.8.0Extension","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The OCSF Schema Extension object provides detailed information about the schema extension used to construct the event. The schema extensions are registered in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://github.com/ocsf/ocsf-schema/blob/main/extensions.md"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"extensions.md"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" file."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The schema extension name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dev"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The schema extension unique identifier. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"999"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The schema extension version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.0.0-alpha.2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["version"]}},"components/schemas/ocsfv1.8.0Feature":{"id":"components/schemas/ocsfv1.8.0Feature","kind":"json-schema","title":"ocsfv1.8.0Feature","data":{"title":"ocsfv1.8.0Feature","type":"object","description":"The Feature object provides information about the software product feature that generated a specific event. It encompasses details related to the capabilities, components, user interface (UI) design, and performance upgrades associated with the feature.","properties":{"name":{"type":"string","nullable":true,"description":"The name of the feature."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the feature."},"version":{"type":"string","nullable":true,"description":"The version of the feature."}}}},"components/schemas/ocsfv1.8.0File":{"id":"components/schemas/ocsfv1.8.0File","kind":"json-schema","title":"ocsfv1.8.0File","data":{"title":"ocsfv1.8.0File","type":"object","description":"The File object represents the metadata associated with a file stored in a computer system. It encompasses information about the file itself, including its attributes, properties, and organizational details.","properties":{"accessed_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the file was last accessed."},"accessed_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the file was last accessed."},"accessor":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The name of the user who last accessed the object."},"attributes":{"type":"integer","nullable":true,"description":"The bitmask value that represents the file attributes."},"company_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the company that published the file. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Microsoft Corporation"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidentiality":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidentiality_id":{"$ref":"#/components/schemas/ocsfv1.8.0File_ConfidentialityId","nullable":true,"description":"The normalized identifier of the file content confidentiality indicator."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the file was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the file was created."},"creator":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The user that created the file."},"desc":{"type":"string","nullable":true,"description":"The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type."},"drive_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The drive type, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"drive_type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"drive_type_id":{"$ref":"#/components/schemas/ocsfv1.8.0File_DriveTypeId","nullable":true,"description":"Identifies the type of a disk drive, i.e. fixed, removable, etc."},"encryption_details":{"$ref":"#/components/schemas/ocsfv1.8.0EncryptionDetails","nullable":true,"description":"The encryption details of the file. Should be populated if the file is encrypted."},"ext":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The extension of the file, excluding the leading dot. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"svchost.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"gz"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"export.tar.gz"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"hashes":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint"},"nullable":true,"description":"An array of hash attributes."},"imported_symbols":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of symbols imported by the executable file."},"internal_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the file as identified within the file itself. This contrasts with the name by which the file is known on disk. Where available, the internal name is widely used by security practitioners and detection content because the on-disk file name is not reliable. On the Windows OS, most PE files contain a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"href":"https://learn.microsoft.com/en-us/windows/win32/menurc/versioninfo-resource"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"VERSIONINFO"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" resource from which the internal name can be obtained. On macOS, binaries can optionally embed a copy of the application's Info.plist file which in turn contains the name of the executable."},"children":[],"type":"text"}],"type":"paragraph"}]},"is_deleted":{"type":"boolean","nullable":true,"description":"Indicates if the file was deleted from the filesystem."},"is_encrypted":{"type":"boolean","nullable":true,"description":"Indicates if the file is encrypted."},"is_public":{"type":"boolean","nullable":true,"description":"Indicates if the file is publicly accessible. For example in an object's public access in AWS S3"},"is_readonly":{"type":"boolean","nullable":true,"description":"Indicates that the file cannot be modified."},"is_system":{"type":"boolean","nullable":true,"description":"The indication of whether the object is part of the operating system."},"mime_type":{"type":"string","nullable":true,"description":"The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the file was last modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the file was last modified."},"modifier":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The user that last modified the file."},"name":{"$ref":"#/components/schemas/ocsfv1.8.0FileName","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the file. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"svchost.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"owner":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The user that owns the file/object."},"parent_folder":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The parent folder in which the file resides. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"c:\\windows\\system32"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"path":{"$ref":"#/components/schemas/ocsfv1.8.0FilePath","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full path to the file. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"c:\\windows\\system32\\svchost.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"product":{"$ref":"#/components/schemas/ocsfv1.8.0Product","nullable":true,"description":"The product that created or installed the file."},"security_descriptor":{"type":"string","nullable":true,"description":"The object security descriptor."},"signature":{"$ref":"#/components/schemas/ocsfv1.8.0DigitalSignature","nullable":true,"description":"The digital signature of the file."},"signatures":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0DigitalSignature"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A collection of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Digital Signature"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects."},"children":[],"type":"text"}],"type":"paragraph"}]},"size":{"type":"integer","nullable":true,"description":"The size of data, in bytes."},"storage_class":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The storage class of the file. For example in AWS S3: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"STANDARD, STANDARD_IA, GLACIER"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the file."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":"The file type."},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0File_TypeId","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The file type ID. Note the distinction between a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Regular File"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Executable File"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". If the distinction is not known, or not indicated by the log, use "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Regular File"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In this case, it should not be assumed that a Regular File is not executable."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the file as defined by the storage system, such the file system file ID."},"uri":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The file URI, such as those reporting by static analysis tools. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"file:///C:/dev/sarif/sarif-tutorials/samples/Introduction/simple-example.js"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"url":{"$ref":"#/components/schemas/ocsfv1.8.0Url","nullable":true,"description":"The URL of the file, when applicable."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The file version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"8.0.7601.17514"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"volume":{"type":"string","nullable":true,"description":"The volume on the storage device where the file is located."},"xattributes":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An unordered collection of zero or more name/value pairs where each pair represents a file or folder extended attribute."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example: Windows alternate data stream attributes (ADS stream name, ADS size, etc.), user-defined or application-defined attributes, ACL, owner, primary group, etc. Examples from DCS: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"ul","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ads_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ads_size"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dacl"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"owner"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"primary_group"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"link_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" - name of the link associated to the file."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"li","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"hard_link_count"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" - the number of links that are associated to the file."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"required":["name","type_id"]}},"components/schemas/ocsfv1.8.0File_ConfidentialityId":{"id":"components/schemas/ocsfv1.8.0File_ConfidentialityId","kind":"json-schema","title":"ocsfv1.8.0File_ConfidentialityId","data":{"title":"ocsfv1.8.0File_ConfidentialityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FileConfidentialityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The confidentiality is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - NotConfidential"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Confidential"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Secret"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - TopSecret"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Private"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Restricted"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidentiality is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidentiality"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0File_DriveTypeId":{"id":"components/schemas/ocsfv1.8.0File_DriveTypeId","kind":"json-schema","title":"ocsfv1.8.0File_DriveTypeId","data":{"title":"ocsfv1.8.0File_DriveTypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FileDriveTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The drive type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Removable: The drive has removable media; for example, a floppy drive, thumb drive, or flash card reader."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Fixed: The drive has fixed media; for example, a hard disk drive or flash drive."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Remote: The drive is a remote (network) drive."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - ROM: The drive is a CD-ROM drive."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - RAMDisk: The drive is a RAM disk."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The drive type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"drive_type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0File_TypeId":{"id":"components/schemas/ocsfv1.8.0File_TypeId","kind":"json-schema","title":"ocsfv1.8.0File_TypeId","data":{"title":"ocsfv1.8.0File_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FileTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - RegularFile"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Folder"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - CharacterDevice"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - BlockDevice"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - LocalSocket"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - NamedPipe"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - SymbolicLink"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - ExecutableFile"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0FindingInfo":{"id":"components/schemas/ocsfv1.8.0FindingInfo","kind":"json-schema","title":"ocsfv1.8.0FindingInfo","data":{"title":"ocsfv1.8.0FindingInfo","type":"object","description":"The Finding Information object describes metadata related to a security finding generated by a security tool or system.","properties":{"analytic":{"$ref":"#/components/schemas/ocsfv1.8.0Analytic","nullable":true,"description":"The analytic technique used to analyze and derive insights from the data or information that led to the finding or conclusion."},"attack_graph":{"$ref":"#/components/schemas/ocsfv1.8.0Graph","nullable":true,"description":"An Attack Graph describes possible routes an attacker could take through an environment. It describes relationships between resources and their findings, such as malware detections, vulnerabilities, misconfigurations, and other security actions."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" technique and associated tactics related to the finding."},"children":[],"type":"text"}],"type":"paragraph"}]},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the finding was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the finding was created."},"data_sources":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of data sources utilized in generation of the finding."},"desc":{"type":"string","nullable":true,"description":"The description of the reported finding."},"first_seen_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The time when the finding was first observed. e.g. The time when a vulnerability was first observed. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"It can differ from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"created_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" timestamp, which reflects the time this finding was created."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"first_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The time when the finding was first observed. e.g. The time when a vulnerability was first observed. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"It can differ from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"created_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" timestamp, which reflects the time this finding was created."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"kill_chain":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KillChainPhase"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Cyber Kill Chain®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" provides a detailed description of each phase and its associated activities within the broader context of a cyber attack."},"children":[],"type":"text"}],"type":"paragraph"}]},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The time when the finding was most recently observed. e.g. The time when a vulnerability was most recently observed. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"It can differ from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"modified_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" timestamp, which reflects the time this finding was last modified."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The time when the finding was most recently observed. e.g. The time when a vulnerability was most recently observed. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"It can differ from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"modified_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" timestamp, which reflects the time this finding was last modified."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the finding was last modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the finding was last modified."},"product":{"$ref":"#/components/schemas/ocsfv1.8.0Product","nullable":true,"description":"Details about the product that reported the finding."},"product_uid":{"type":"string","nullable":true,"description":"The unique identifier of the product that reported the finding."},"related_analytics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Analytic"},"nullable":true,"description":"Other analytics related to this finding."},"related_events":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0RelatedEvent"},"nullable":true,"description":"Describes events and/or other findings related to the finding as identified by the security product. Note that these events may or may not be in OCSF."},"related_events_count":{"type":"integer","nullable":true,"description":"Number of related events or findings."},"src_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":"The URL pointing to the source of the finding."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated with the finding."},"children":[],"type":"text"}],"type":"paragraph"}]},"title":{"type":"string","nullable":true,"description":"A title or a brief phrase summarizing the reported finding."},"traits":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Trait"},"nullable":true,"description":"The list of key traits or characteristics extracted from the finding."},"types":{"type":"array","items":{"type":"string"},"nullable":true,"description":"One or more types of the reported finding."},"uid":{"type":"string","description":"The unique identifier of the reported finding."},"uid_alt":{"type":"string","nullable":true,"description":"The alternative unique identifier of the reported finding."},"xattributes":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"An unordered collection of zero or more name/value pairs that represent a finding's extended attributes and are specific to the event source."}},"required":["uid"]}},"components/schemas/ocsfv1.8.0Fingerprint":{"id":"components/schemas/ocsfv1.8.0Fingerprint","kind":"json-schema","title":"ocsfv1.8.0Fingerprint","data":{"title":"ocsfv1.8.0Fingerprint","type":"object","description":"The Fingerprint object provides detailed information about a fingerprint, which is a compact representation of data used to identify a longer piece of information, such as a public key, file content, or application implementation. It contains the algorithm or scheme and value of the fingerprint, enabling efficient and reliable identification of the associated data.","properties":{"algorithm":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The algorithm or scheme used to create the fingerprint, normalized to the caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"algorithm_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"algorithm_id":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint_AlgorithmId","description":"The identifier of the normalized algorithm or scheme, which was used to create the fingerprint."},"value":{"$ref":"#/components/schemas/ocsfv1.8.0Hash","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The fingerprint value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" This uses type "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"file_hash_t"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (\"Hash\"), which has been generalized for all fingerprints but retains the same name and caption for backwards compatibility."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"required":["algorithm_id","value"]}},"components/schemas/ocsfv1.8.0Fingerprint_AlgorithmId":{"id":"components/schemas/ocsfv1.8.0Fingerprint_AlgorithmId","kind":"json-schema","title":"ocsfv1.8.0Fingerprint_AlgorithmId","data":{"title":"ocsfv1.8.0Fingerprint_AlgorithmId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FingerprintAlgorithmId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The algorithm is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context Triggered Piecewise Hash (CTPH)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - TLSH: The TLSH fuzzy hashing algorithm."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that works by XORing the bytes in a circular-shifting fashion."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - 224: Secure Hash Algorithm 2 producing a 224-bit (28-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - 384: Secure Hash Algorithm 2 producing a 384-bit (48-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - 512_224: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash value truncated to a 224-bit (28-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - 512_256: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash value truncated to a 256-bit (32-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - 224: Secure Hash Algorithm 3 producing a 224-bit (28-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - 256: Secure Hash Algorithm 3 producing a 256-bit (32-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - 384: Secure Hash Algorithm 3 producing a 384-bit (48-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - 512: Secure Hash Algorithm 3 producing a 512-bit (64-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - bit: xxHash H3 producing a 64-bit hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - bit: xxHash H3 producing a 128-bit hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Imphash: Import hash (imphash) based on the import table of a Portable Executable (PE) file producing a 128-bit (16-byte) hash value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - NPF: Network Protocol Fingerprint (NPF) used to identify network protocols and applications."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - HASSH: HASSH is a network fingerprinting standard which can be used to identify specific SSH client and server implementations."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The algorithm is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"algorithm"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0FirewallRule":{"id":"components/schemas/ocsfv1.8.0FirewallRule","kind":"json-schema","title":"ocsfv1.8.0FirewallRule","data":{"title":"ocsfv1.8.0FirewallRule","type":"object","description":"The Firewall Rule object represents a specific rule within a firewall policy or event. It contains information about a rule's configuration, properties, and associated actions that define how network traffic is handled by the firewall.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action the rule applies to matching traffic, normalized to the caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the source. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"goto_next"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule_ActionId","nullable":true,"description":"The normalized action the rule applies to matching traffic."},"category":{"type":"string","nullable":true,"description":"The rule category."},"condition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The rule trigger condition for the rule. For example: SQL_INJECTION."},"children":[],"type":"text"}],"type":"paragraph"}]},"desc":{"type":"string","nullable":true,"description":"The description of the rule that generated the event."},"direction":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The direction of the traffic the rule applies to, normalized to the caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"direction_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"direction_id":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule_DirectionId","nullable":true,"description":"The normalized direction of the traffic the rule applies to."},"dst_ip_ranges":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Subnet"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The destination IP ranges, in CIDR notation, that a rule matches. Absent when the rule matches its destination by something other than an IP range, such as a security group, prefix list or network tag; an absent range never means any address. A rule open to every address lists "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"0.0.0.0/0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"::/0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":"The rule response time duration, usually used for challenge completion time."},"evaluation_priority":{"type":"integer","nullable":true,"description":"The rule's priority within the policy or rule set it belongs to; lower values are evaluated first."},"is_disabled":{"type":"boolean","nullable":true,"description":"Indicates whether the rule is disabled and so not applied."},"is_logging_enabled":{"type":"boolean","nullable":true,"description":"Indicates whether traffic the rule matches is logged."},"match_details":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The data in a request that rule matched. For example: '[\"10\",\"and\",\"1\"]'."},"children":[],"type":"text"}],"type":"paragraph"}]},"match_location":{"type":"string","nullable":true,"description":"The location of the matched data in the source which resulted in the triggered firewall rule. For example: HEADER."},"name":{"type":"string","nullable":true,"description":"The name of the rule that generated the event."},"protocol_ports":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRuleProtocol"},"nullable":true,"description":"The protocols, and for each its ports, that a rule matches."},"rate_limit":{"type":"integer","nullable":true,"description":"The rate limit for a rate-based rule."},"sensitivity":{"type":"string","nullable":true,"description":"The sensitivity of the firewall rule in the matched event. For example: HIGH."},"src_ip_ranges":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Subnet"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The source IP ranges, in CIDR notation, that a rule matches. Absent when the rule matches its source by something other than an IP range, such as a security group, prefix list or network tag; an absent range never means any address. A rule open to every address lists "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"0.0.0.0/0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"::/0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":"The rule type."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the rule that generated the event."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The rule version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"vpc_uid":{"type":"string","nullable":true,"description":"The unique identifier of the network the rule is applied to."}}}},"components/schemas/ocsfv1.8.0FirewallRule_ActionId":{"id":"components/schemas/ocsfv1.8.0FirewallRule_ActionId","kind":"json-schema","title":"ocsfv1.8.0FirewallRule_ActionId","data":{"title":"ocsfv1.8.0FirewallRule_ActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FirewallRuleActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action was not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0FirewallRule_DirectionId":{"id":"components/schemas/ocsfv1.8.0FirewallRule_DirectionId","kind":"json-schema","title":"ocsfv1.8.0FirewallRule_DirectionId","data":{"title":"ocsfv1.8.0FirewallRule_DirectionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FirewallRuleDirectionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The connection direction is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Inbound: Inbound network connection. The connection originated from the Internet or outside network, destined for services on the inside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Outbound: Outbound network connection. The connection originated from inside the network, destined for services on the Internet or outside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Lateral: Lateral network connection. The connection originated from inside the network, destined for services on the inside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Local: Local network connection ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"localhost"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"). The connection is intra-device, originating from and destined for services running on the same device."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The direction is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"direction"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0FirewallRuleProtocol":{"id":"components/schemas/ocsfv1.8.0FirewallRuleProtocol","kind":"json-schema","title":"ocsfv1.8.0FirewallRuleProtocol","data":{"title":"ocsfv1.8.0FirewallRuleProtocol","type":"object","description":"A protocol a firewall rule matches, with the ports it matches for that protocol.","properties":{"port_ranges":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The destination ports matched for this protocol. Absent when the rule matches every port."},"protocol_name":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The protocol matched, as named by the source. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tcp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"udp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"icmp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"all"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"protocol_num":{"type":"integer","nullable":true,"description":"The IANA protocol number, when the source gives one."}},"required":["protocol_name"]}},"components/schemas/ocsfv1.8.0GpuInfo":{"id":"components/schemas/ocsfv1.8.0GpuInfo","kind":"json-schema","title":"ocsfv1.8.0GpuInfo","data":{"title":"ocsfv1.8.0GpuInfo","type":"object","description":"The GPU information object contains attributes describing graphical processing hardware.","properties":{"bus_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The attachment bus or interface standard, normalized to the caption of the bus_type_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"bus_type_id":{"$ref":"#/components/schemas/ocsfv1.8.0GpuInfo_BusTypeId","nullable":true,"description":"The normalized identifier of the attachment bus or interface standard."},"cores":{"type":"integer","nullable":true,"description":"The number of processing cores or compute units for the component."},"model":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The model name of the GPU. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"GeForce RTX A6000"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Radeon PRO W7900"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Intel Data Center GPU Max 1550"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"vendor_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the vendor of the GPU. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NVIDIA"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AMD"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Intel"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"vram_mode":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The video memory attachment mode, indicating how the VRAM hardware is integrated with the system (e.g., shared or dedicated), normalized to the caption of the vram_mode_id value. For 'Other', the exact attachment mode is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"vram_mode_id":{"$ref":"#/components/schemas/ocsfv1.8.0GpuInfo_VramModeId","nullable":true,"description":"The normalized identifier of the video memory attachment mode."},"vram_size":{"type":"integer","nullable":true,"description":"The total amount of installed video RAM."}}}},"components/schemas/ocsfv1.8.0GpuInfo_BusTypeId":{"id":"components/schemas/ocsfv1.8.0GpuInfo_BusTypeId","kind":"json-schema","title":"ocsfv1.8.0GpuInfo_BusTypeId","data":{"title":"ocsfv1.8.0GpuInfo_BusTypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"GpuInfoBusTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The bus type is unknown or not reported."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Onboard: The device is attached directly on the motherboard or SoC (often referred to as 'integrated' or 'onboard')."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - PCIex16: Peripheral Component Interconnect Express slot with 16 lanes, typically used for high‑bandwidth add‑in devices."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - PCIex8: Peripheral Component Interconnect Express slot with 8 lanes; common for high‑performance NICs, storage controllers, and accelerators."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - MXMTypeA: Mobile PCI Express Module (MXM) Type A form factor (compact laptop/embedded GPU module)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - MXMTypeB: Mobile PCI Express Module (MXM) Type B form factor (larger laptop/embedded GPU module)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - 2: M.2 (NGFF) internal module form factor/connector exposing PCIe (and/or SATA/USB) for SSDs and add‑in modules."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CXL: Compute Express Link (CXL), an open cache‑coherent interconnect for processors, memory expansion, and accelerators built on the PCIe physical layer."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: A bus or interface standard not covered by the defined values; the exact value is reported by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0GpuInfo_VramModeId":{"id":"components/schemas/ocsfv1.8.0GpuInfo_VramModeId","kind":"json-schema","title":"ocsfv1.8.0GpuInfo_VramModeId","data":{"title":"ocsfv1.8.0GpuInfo_VramModeId","type":"integer","description":"GpuInfoVramModeId is an enum, and the following values are allowed.\n0 - Unknown: The VRAM mode is unknown or not reported.\n1 - Shared: Video memory is allocated from system memory.\n2 - Dedicated: Video memory is physically separate from system memory.\n99 - Other: A VRAM mode not covered by the defined values; the exact value is reported by the event source."}},"components/schemas/ocsfv1.8.0Graph":{"id":"components/schemas/ocsfv1.8.0Graph","kind":"json-schema","title":"ocsfv1.8.0Graph","data":{"title":"ocsfv1.8.0Graph","type":"object","description":"A graph data structure representation with nodes and edges.","properties":{"desc":{"type":"string","nullable":true,"description":"The graph description - provides additional details about the graph's purpose and contents."},"edges":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Edge"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The edges/connections between nodes in the graph - contains the collection of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"edge"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects defining relationships between nodes."},"children":[],"type":"text"}],"type":"paragraph"}]},"is_directed":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates if the graph is directed ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") or undirected ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"false"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","nullable":true,"description":"The graph name - a human readable identifier for the graph."},"nodes":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Node"},"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The nodes/vertices of the graph - contains the collection of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"node"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects that make up the graph."},"children":[],"type":"text"}],"type":"paragraph"}]},"query_language":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The graph query language, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"query_language_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value."},"children":[],"type":"text"}],"type":"paragraph"}]},"query_language_id":{"$ref":"#/components/schemas/ocsfv1.8.0Graph_QueryLanguageId","nullable":true,"description":"The normalized identifier of a graph query language that can be used to interact with the graph."},"type":{"type":"string","nullable":true,"description":"The graph type. Typically useful to represent the specific type of graph that is used."},"uid":{"type":"string","nullable":true,"description":"Unique identifier of the graph - a unique ID to reference this specific graph."}},"required":["nodes"]}},"components/schemas/ocsfv1.8.0Graph_QueryLanguageId":{"id":"components/schemas/ocsfv1.8.0Graph_QueryLanguageId","kind":"json-schema","title":"ocsfv1.8.0Graph_QueryLanguageId","data":{"title":"ocsfv1.8.0Graph_QueryLanguageId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"GraphQueryLanguageId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The Query Language is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Cypher: A declarative graph query language developed by Neo4j that allows for expressive and efficient querying of graph databases."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - GraphQL: A query language for APIs that enables declarative data fetching and provides a complete description of the data in the API."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Gremlin: A graph traversal language and virtual machine developed by Apache TinkerPop that enables graph computing across different graph databases."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - GQL: An ISO standard graph query language designed to provide a unified way to query graph databases."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - CORE: A graph query language that combines features from existing languages while adding support for paths as first-class citizens."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - PGQL: Property Graph Query Language developed by Oracle that provides SQL-like syntax for querying property graphs."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - SPARQL: A semantic query language for databases that enables querying and manipulating data stored in RDF format."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The Query Language is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"query_language"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Group":{"id":"components/schemas/ocsfv1.8.0Group","kind":"json-schema","title":"ocsfv1.8.0Group","data":{"title":"ocsfv1.8.0Group","type":"object","description":"The Group object represents a collection or association of entities, such as users, policies, or devices. It serves as a logical grouping mechanism to organize and manage entities with similar characteristics or permissions within a system or organization, including but not limited to purposes of access control.","properties":{"desc":{"type":"string","nullable":true,"description":"The group description."},"domain":{"type":"string","nullable":true,"description":"The domain where the group is defined. For example: the LDAP or Active Directory domain."},"email_addr":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress","nullable":true,"description":"The group's email address. For example, a Google Group email address."},"name":{"type":"string","nullable":true,"description":"The group name."},"privileges":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The group privileges."},"type":{"type":"string","nullable":true,"description":"The type of the group."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. Another example, pool id or desktop id that the device belongs to."},"uid_alt":{"type":"string","nullable":true,"description":"The alternate unique identifier."}}}},"components/schemas/ocsfv1.8.0HttpHeader":{"id":"components/schemas/ocsfv1.8.0HttpHeader","kind":"json-schema","title":"ocsfv1.8.0HttpHeader","data":{"title":"ocsfv1.8.0HttpHeader","type":"object","description":"The HTTP Header object represents the headers sent in an HTTP request or response. HTTP headers are key-value pairs that convey additional information about the HTTP message, including details about the content, caching, authentication, encoding, and other aspects of the communication.","properties":{"name":{"type":"string","description":"The name of the HTTP header."},"value":{"type":"string","description":"The value of the HTTP header."}},"required":["name","value"]}},"components/schemas/ocsfv1.8.0HttpRequest":{"id":"components/schemas/ocsfv1.8.0HttpRequest","kind":"json-schema","title":"ocsfv1.8.0HttpRequest","data":{"title":"ocsfv1.8.0HttpRequest","type":"object","description":"The HTTP Request object represents the attributes of a request made to a web server. It encapsulates the details and metadata associated with an HTTP request, including the request method, headers, URL, query parameters, body content, and other relevant information.","properties":{"args":{"type":"string","nullable":true,"description":"The arguments sent along with the HTTP request."},"body_length":{"type":"integer","nullable":true,"description":"The actual length of the HTTP request body, in number of bytes, independent of a potentially existing Content-Length header."},"http_headers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0HttpHeader"},"nullable":true,"description":"Additional HTTP headers of an HTTP request or response."},"http_method":{"$ref":"#/components/schemas/ocsfv1.8.0HttpRequest_HttpMethod","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"HTTP request method"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" indicates the desired action to be performed for a given resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"length":{"type":"integer","nullable":true,"description":"The length of the entire HTTP request, in number of bytes."},"referrer":{"type":"string","nullable":true,"description":"The request header that identifies the address of the previous web page, which is linked to the current web page or resource being requested."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the http request."},"url":{"$ref":"#/components/schemas/ocsfv1.8.0Url","nullable":true,"description":"The URL object that pertains to the request."},"user_agent":{"type":"string","nullable":true,"description":"The request header that identifies the operating system and web browser."},"version":{"type":"string","nullable":true,"description":"The Hypertext Transfer Protocol (HTTP) version."},"x_forwarded_for":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0IPAddress"},"nullable":true,"description":"The X-Forwarded-For header identifying the originating IP address(es) of a client connecting to a web server through an HTTP proxy or a load balancer."}}}},"components/schemas/ocsfv1.8.0HttpRequest_HttpMethod":{"id":"components/schemas/ocsfv1.8.0HttpRequest_HttpMethod","kind":"json-schema","title":"ocsfv1.8.0HttpRequest_HttpMethod","data":{"title":"ocsfv1.8.0HttpRequest_HttpMethod","type":"string","description":"HttpRequestHttpMethod is an enum, and the following values are allowed.\nCONNECT - Connect: The CONNECT method establishes a tunnel to the server identified by the target resource.\nDELETE - Delete: The DELETE method deletes the specified resource.\nGET - Get: The GET method requests a representation of the specified resource. Requests using GET should only retrieve data.\nHEAD - Head: The HEAD method asks for a response identical to a GET request, but without the response body.\nOPTIONS - Options: The OPTIONS method describes the communication options for the target resource.\nPATCH - Patch: The PATCH method applies partial modifications to a resource.\nPOST - Post: The POST method submits an entity to the specified resource, often causing a change in state or side effects on the server.\nPUT - Put: The PUT method replaces all current representations of the target resource with the request payload.\nTRACE - Trace: The TRACE method performs a message loop-back test along the path to the target resource."}},"components/schemas/ocsfv1.8.0HttpResponse":{"id":"components/schemas/ocsfv1.8.0HttpResponse","kind":"json-schema","title":"ocsfv1.8.0HttpResponse","data":{"title":"ocsfv1.8.0HttpResponse","type":"object","description":"The HTTP Response object contains detailed information about the response sent from a web server to the requester. It encompasses attributes and metadata that describe the response status, headers, body content, and other relevant information.","properties":{"body_length":{"type":"integer","nullable":true,"description":"The actual length of the HTTP response body, in number of bytes, independent of a potentially existing Content-Length header."},"code":{"type":"integer","description":"The Hypertext Transfer Protocol (HTTP) status code returned from the web server to the client. For example, 200."},"content_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The request header that identifies the original "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.iana.org/assignments/media-types/media-types.xhtml"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"media type "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the resource (prior to any content encoding applied for sending)."},"children":[],"type":"text"}],"type":"paragraph"}]},"http_headers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0HttpHeader"},"nullable":true,"description":"Additional HTTP headers of an HTTP request or response."},"latency":{"type":"integer","nullable":true,"description":"The HTTP response latency measured in milliseconds."},"length":{"type":"integer","nullable":true,"description":"The length of the entire HTTP response, in number of bytes."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"status":{"type":"string","nullable":true,"description":"The response status. For example: A successful HTTP status of 'OK' which corresponds to a code of 200."}},"required":["code"]}},"components/schemas/ocsfv1.8.0IamRole":{"id":"components/schemas/ocsfv1.8.0IamRole","kind":"json-schema","title":"ocsfv1.8.0IamRole","data":{"title":"ocsfv1.8.0IamRole","type":"object","description":"The IAM Role object describes permission characteristics (or privileges) associated with a user or group of users as security principals against one or more resources. In some cases only the name or ID of the role is known hence other attributes are optional. In some systems a user or group of users can have multiple roles, imparting the union of privileges to the principal. In some systems the role can serve as a temporary security principal without its own credentials on behalf of the actual security principal.","properties":{"account":{"$ref":"#/components/schemas/ocsfv1.8.0Account","nullable":true,"description":"The account associated with the role. For example, can be a cross-account role, different from the user or group account, granting access within this account."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The role name. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Power Users"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"policies":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Policy"},"nullable":true,"description":"IAM policies associated with the role."},"privileges":{"type":"array","items":{"type":"string"},"nullable":true,"description":"List of privileges assigned to a role."},"programmatic_credentials":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ProgrammaticCredential"},"nullable":true,"description":"Programmatic credential (API keys, access tokens, certificates, etc) associated with the role."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails"},"nullable":true,"description":"Resources that the role applies to."},"session":{"$ref":"#/components/schemas/ocsfv1.8.0Session","nullable":true,"description":"The session where the role is active. Some roles may be temporary and expire when the session expires."},"uid":{"type":"string","nullable":true,"description":"The unique role identifier. For example, the Windows role SID, or AWS role ARN."},"uid_alt":{"type":"string","nullable":true,"description":"The alternate user identifier. For example, the Active Directory role GUID or the associated LDAP group DN."}}}},"components/schemas/ocsfv1.8.0Idp":{"id":"components/schemas/ocsfv1.8.0Idp","kind":"json-schema","title":"ocsfv1.8.0Idp","data":{"title":"ocsfv1.8.0Idp","type":"object","description":"The Identity Provider object contains detailed information about a provider responsible for creating, maintaining, and managing identity information while offering authentication services to applications. An Identity Provider (IdP) serves as a trusted authority that verifies the identity of users and issues authentication tokens or assertions to enable secure access to applications or services.","properties":{"auth_factors":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0AuthFactor"},"nullable":true,"description":"The Authentication Factors object describes the different types of Multi-Factor Authentication (MFA) methods and/or devices supported by the Identity Provider."},"domain":{"type":"string","nullable":true,"description":"The primary domain associated with the Identity Provider."},"fingerprint":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":"The fingerprint of the X.509 certificate used by the Identity Provider."},"has_mfa":{"type":"boolean","nullable":true,"description":"The Identity Provider enforces Multi Factor Authentication (MFA)."},"issuer":{"type":"string","nullable":true,"description":"The unique identifier (often a URL) used by the Identity Provider as its issuer."},"name":{"type":"string","nullable":true,"description":"The name of the Identity Provider."},"protocol_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The supported protocol of the Identity Provider. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SAML"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OIDC"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OAuth2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"scim":{"$ref":"#/components/schemas/ocsfv1.8.0Scim","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The System for Cross-domain Identity Management (SCIM) resource object provides a structured set of attributes related to SCIM protocols used for identity provisioning and management across cloud-based platforms. It standardizes user and group provisioning details, enabling identity synchronization and lifecycle management with compatible Identity Providers (IdPs) and applications. SCIM is defined in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc7643"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-7634"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"sso":{"$ref":"#/components/schemas/ocsfv1.8.0Sso","nullable":true,"description":"The Single Sign-On (SSO) object provides a structure for normalizing SSO attributes, configuration, and/or settings from Identity Providers."},"state":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The configuration state of the Identity Provider, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"state_id":{"$ref":"#/components/schemas/ocsfv1.8.0Idp_StateId","nullable":true,"description":"The normalized state ID of the Identity Provider to reflect its configuration or activation status."},"tenant_uid":{"type":"string","nullable":true,"description":"The tenant ID associated with the Identity Provider."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the Identity Provider."},"url_string":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":"The URL for accessing the configuration or metadata of the Identity Provider."}}}},"components/schemas/ocsfv1.8.0Idp_StateId":{"id":"components/schemas/ocsfv1.8.0Idp_StateId","kind":"json-schema","title":"ocsfv1.8.0Idp_StateId","data":{"title":"ocsfv1.8.0Idp_StateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IdpStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The configuration state of the Identity Provider is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Active: The Identity Provider is in an Active state, or otherwise enabled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Suspended: The Identity Provider is in a Suspended state."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Deprecated: The Identity Provider is in a Deprecated state, or is otherwise disabled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Deleted: The Identity Provider is in a Deleted state."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The configuration state of the Identity Provider is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Image":{"id":"components/schemas/ocsfv1.8.0Image","kind":"json-schema","title":"ocsfv1.8.0Image","data":{"title":"ocsfv1.8.0Image","type":"object","description":"The Image object provides a description of a specific Virtual Machine (VM) or Container image.","properties":{"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels associated to the image."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The image name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"elixir"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"path":{"$ref":"#/components/schemas/ocsfv1.8.0FilePath","nullable":true,"description":"The full path to the image file."},"tag":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The image tag. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.11-alpine"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the image."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique image ID. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"77af4d6b9913"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["uid"]}},"components/schemas/ocsfv1.8.0Ja4Fingerprint":{"id":"components/schemas/ocsfv1.8.0Ja4Fingerprint","kind":"json-schema","title":"ocsfv1.8.0Ja4Fingerprint","data":{"title":"ocsfv1.8.0Ja4Fingerprint","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The JA4+ fingerprint object provides detailed fingerprint information about various aspects of network traffic which is both machine and human readable."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"section_a":{"type":"string","nullable":true,"description":"The 'a' section of the JA4 fingerprint."},"section_b":{"type":"string","nullable":true,"description":"The 'b' section of the JA4 fingerprint."},"section_c":{"type":"string","nullable":true,"description":"The 'c' section of the JA4 fingerprint."},"section_d":{"type":"string","nullable":true,"description":"The 'd' section of the JA4 fingerprint."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The JA4+ fingerprint type as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"href":"https://blog.foxio.io/ja4+-network-fingerprinting target="}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"FoxIO"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", normalized to the caption of 'type_id'. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Ja4Fingerprint_TypeId","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The identifier of the JA4+ fingerprint type."},"children":[],"type":"text"}],"type":"paragraph"}]},"value":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The JA4+ fingerprint value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["type_id","value"]}},"components/schemas/ocsfv1.8.0Ja4Fingerprint_TypeId":{"id":"components/schemas/ocsfv1.8.0Ja4Fingerprint_TypeId","kind":"json-schema","title":"ocsfv1.8.0Ja4Fingerprint_TypeId","data":{"title":"ocsfv1.8.0Ja4Fingerprint_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Ja4FingerprintTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - JA4: TLS Client Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - JA4Server: TLS Server Response/Session Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - JA4HTTP: HTTP Client Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - JA4Latency: Latency Measurement/Light Distance Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - JA4X509: X509 TLS Certificate Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - JA4SSH: SSH Traffic Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - JA4TCP: Passive TCP Client Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - JA4TCPServer: Passive TCP Server Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - JA4TCPScan: Active TCP Server Fingerprint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Job":{"id":"components/schemas/ocsfv1.8.0Job","kind":"json-schema","title":"ocsfv1.8.0Job","data":{"title":"ocsfv1.8.0Job","type":"object","description":"The Job object provides information about a scheduled job or task, including its name, command line, and state. It encompasses attributes that describe the properties and status of the scheduled job.","properties":{"cmd_line":{"type":"string","nullable":true,"description":"The job command line."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the job was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the job was created."},"desc":{"type":"string","nullable":true,"description":"The description of the job."},"file":{"$ref":"#/components/schemas/ocsfv1.8.0File","nullable":true,"description":"The file that pertains to the job."},"last_run_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the job was last run."},"last_run_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the job was last run."},"name":{"type":"string","description":"The name of the job."},"next_run_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the job will next be run."},"next_run_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the job will next be run."},"run_state":{"type":"string","nullable":true,"description":"The run state of the job."},"run_state_id":{"$ref":"#/components/schemas/ocsfv1.8.0Job_RunStateId","nullable":true,"description":"The run state ID of the job."},"user":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The user that created the job."}},"required":["name"]}},"components/schemas/ocsfv1.8.0Job_RunStateId":{"id":"components/schemas/ocsfv1.8.0Job_RunStateId","kind":"json-schema","title":"ocsfv1.8.0Job_RunStateId","data":{"title":"ocsfv1.8.0Job_RunStateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"JobRunStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The run state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Ready"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Queued"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Running"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Stopped"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The run state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"run_state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0KbArticle":{"id":"components/schemas/ocsfv1.8.0KbArticle","kind":"json-schema","title":"ocsfv1.8.0KbArticle","data":{"title":"ocsfv1.8.0KbArticle","type":"object","description":"The KB Article object contains metadata that describes the patch or update.","properties":{"avg_timespan":{"$ref":"#/components/schemas/ocsfv1.8.0Timespan","nullable":true,"description":"The average time to patch."},"bulletin":{"type":"string","nullable":true,"description":"The kb article bulletin identifier."},"classification":{"type":"string","nullable":true,"description":"The vendors classification of the kb article."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The date the kb article was released by the vendor."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The date the kb article was released by the vendor."},"install_state":{"type":"string","nullable":true,"description":"The install state of the kb article."},"install_state_id":{"$ref":"#/components/schemas/ocsfv1.8.0KbArticle_InstallStateId","nullable":true,"description":"The normalized install state ID of the kb article."},"is_superseded":{"type":"boolean","nullable":true,"description":"The kb article has been replaced by another."},"os":{"$ref":"#/components/schemas/ocsfv1.8.0Os","nullable":true,"description":"The operating system the kb article applies."},"product":{"$ref":"#/components/schemas/ocsfv1.8.0Product","nullable":true,"description":"The product details the kb article applies."},"severity":{"type":"string","nullable":true,"description":"The severity of the kb article."},"size":{"type":"integer","nullable":true,"description":"The size in bytes for the kb article."},"src_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":"The kb article link from the source vendor."},"title":{"type":"string","nullable":true,"description":"The title of the kb article."},"uid":{"type":"string","nullable":true,"description":"The unique identifier for the kb article."}}}},"components/schemas/ocsfv1.8.0KbArticle_InstallStateId":{"id":"components/schemas/ocsfv1.8.0KbArticle_InstallStateId","kind":"json-schema","title":"ocsfv1.8.0KbArticle_InstallStateId","data":{"title":"ocsfv1.8.0KbArticle_InstallStateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"KbArticleInstallStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized install state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Installed: The item is installed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - NotInstalled: The item is not installed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - InstalledPendingReboot: The item is installed pending reboot operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The install state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"install_state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0KeyValueObject":{"id":"components/schemas/ocsfv1.8.0KeyValueObject","kind":"json-schema","title":"ocsfv1.8.0KeyValueObject","data":{"title":"ocsfv1.8.0KeyValueObject","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A generic object allowing to define a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pair."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","description":"The name of the key."},"value":{"type":"string","nullable":true,"description":"The value associated to the key."},"values":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Optional, the values associated to the key. You can populate this attribute, when you have multiple values for the same key."}},"required":["name"]}},"components/schemas/ocsfv1.8.0KeyboardInfo":{"id":"components/schemas/ocsfv1.8.0KeyboardInfo","kind":"json-schema","title":"ocsfv1.8.0KeyboardInfo","data":{"title":"ocsfv1.8.0KeyboardInfo","type":"object","description":"The Keyboard Information object contains details and attributes related to a computer or device keyboard. It encompasses information that describes the characteristics, capabilities, and configuration of the keyboard.","properties":{"function_keys":{"type":"integer","nullable":true,"description":"The number of function keys on client keyboard."},"ime":{"type":"string","nullable":true,"description":"The Input Method Editor (IME) file name."},"keyboard_layout":{"type":"string","nullable":true,"description":"The keyboard locale identifier name (e.g., en-US)."},"keyboard_subtype":{"type":"integer","nullable":true,"description":"The keyboard numeric code."},"keyboard_type":{"type":"string","nullable":true,"description":"The keyboard type (e.g., xt, ico)."}}}},"components/schemas/ocsfv1.8.0KillChainPhase":{"id":"components/schemas/ocsfv1.8.0KillChainPhase","kind":"json-schema","title":"ocsfv1.8.0KillChainPhase","data":{"title":"ocsfv1.8.0KillChainPhase","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Kill Chain Phase object represents a single phase of a cyber attack, including the initial reconnaissance and planning stages up to the final objective of the attacker. It provides a detailed description of each phase and its associated activities within the broader context of a cyber attack. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Cyber Kill Chain®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"phase":{"type":"string","nullable":true,"description":"The cyber kill chain phase."},"phase_id":{"$ref":"#/components/schemas/ocsfv1.8.0KillChainPhase_PhaseId","description":"The cyber kill chain phase identifier."}},"required":["phase_id"]}},"components/schemas/ocsfv1.8.0KillChainPhase_PhaseId":{"id":"components/schemas/ocsfv1.8.0KillChainPhase_PhaseId","kind":"json-schema","title":"ocsfv1.8.0KillChainPhase_PhaseId","data":{"title":"ocsfv1.8.0KillChainPhase_PhaseId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"KillChainPhasePhaseId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The kill chain phase is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Reconnaissance: The attackers pick a target and perform a detailed analysis, start collecting information (email addresses, conferences information, etc.) and evaluate the victim’s vulnerabilities to determine how to exploit them."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Weaponization: The attackers develop a malware weapon and aim to exploit the discovered vulnerabilities."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Delivery: The intruders will use various tactics, such as phishing, infected USB drives, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Exploitation: The intruders start leveraging vulnerabilities to executed code on the victim’s system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Installation: The intruders install malware on the victim’s system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Control: Malware opens a command channel to enable the intruders to remotely manipulate the victim's system."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - ActionsonObjectives: With hands-on keyboard access, intruders accomplish the mission’s goal."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The kill chain phase is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"phase"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0LdapPerson":{"id":"components/schemas/ocsfv1.8.0LdapPerson","kind":"json-schema","title":"ocsfv1.8.0LdapPerson","data":{"title":"ocsfv1.8.0LdapPerson","type":"object","description":"The additional LDAP attributes that describe a person.","properties":{"cost_center":{"type":"string","nullable":true,"description":"The cost center associated with the user."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The timestamp when the user was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user was created."},"deleted_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The timestamp when the user was deleted. In Active Directory (AD), when a user is deleted they are moved to a temporary container and then removed after 30 days. So, this field can be populated even after a user is deleted for the next 30 days."},"deleted_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user was deleted. In Active Directory (AD), when a user is deleted they are moved to a temporary container and then removed after 30 days. So, this field can be populated even after a user is deleted for the next 30 days."},"department":{"type":"string","nullable":true,"description":"The name of the department in which the user works."},"display_name":{"type":"string","nullable":true,"description":"The display name of the LDAP person. According to RFC 2798, this is the preferred name of a person to be used when displaying entries."},"email_addrs":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress"},"nullable":true,"description":"A list of additional email addresses for the user."},"employee_uid":{"type":"string","nullable":true,"description":"The employee identifier assigned to the user by the organization."},"given_name":{"type":"string","nullable":true,"description":"The given or first name of the user."},"hire_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The timestamp when the user was or will be hired by the organization."},"hire_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user was or will be hired by the organization."},"job_title":{"type":"string","nullable":true,"description":"The user's job title."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The labels associated with the user. For example in AD this could be the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"userType"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"employeeType"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Member, Employee"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"last_login_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The last time when the user logged in."},"last_login_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The last time when the user logged in."},"ldap_cn":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The LDAP and X.500 "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"commonName"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, typically the full name of the person. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"John Doe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"ldap_dn":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The X.500 Distinguished Name (DN) is a structured string that uniquely identifies an entry, such as a user, in an X.500 directory service For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cn=John Doe,ou=People,dc=example,dc=com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"leave_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The timestamp when the user left or will be leaving the organization."},"leave_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user left or will be leaving the organization."},"location":{"$ref":"#/components/schemas/ocsfv1.8.0Location","nullable":true,"description":"The geographical location associated with a user. This is typically the user's usual work location."},"manager":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The user's manager. This helps in understanding an org hierarchy. This should only ever be populated once in an event. I.e. there should not be a manager's manager in an event."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The timestamp when the user entry was last modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the user entry was last modified."},"office_location":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The primary office location associated with the user. This could be any string and isn't a specific address. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"South East Virtual"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"phone_number":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The telephone number of the user. Corresponds to the LDAP "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Telephone-Number"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" CN."},"children":[],"type":"text"}],"type":"paragraph"}]},"surname":{"type":"string","nullable":true,"description":"The last or family name for the user."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the user."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0Location":{"id":"components/schemas/ocsfv1.8.0Location","kind":"json-schema","title":"ocsfv1.8.0Location","data":{"title":"ocsfv1.8.0Location","type":"object","description":"The Geo Location object describes a geographical location, usually associated with an IP address.","properties":{"aerial_height":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Expressed as either height above takeoff location or height above ground level (AGL) for a UAS current location. This value is provided in meters and must have a minimum resolution of 1 m. Special Values: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Invalid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"No Value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Unknown: -1000 m"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"city":{"type":"string","nullable":true,"description":"The name of the city."},"continent":{"type":"string","nullable":true,"description":"The name of the continent."},"coordinates":{"type":"array","items":{"type":"number","format":"double"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A two-element array, containing a longitude/latitude pair. The format conforms with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://geojson.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"GeoJSON"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[-73.983, 40.719]"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"country":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The ISO 3166-1 Alpha-2 country code."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" The two letter country code should be capitalized. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"US"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CA"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"desc":{"type":"string","nullable":true,"description":"The description of the geographical location."},"geodetic_altitude":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The aircraft distance above or below the ellipsoid as measured along a line that passes through the aircraft and is normal to the surface of the WGS-84 ellipsoid. This value is provided in meters and must have a minimum resolution of 1 m. Special Values: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Invalid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"No Value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Unknown: -1000 m"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"geodetic_vertical_accuracy":{"type":"string","nullable":true,"description":"Provides quality/containment on geodetic altitude. This is based on ADS-B Geodetic Vertical Accuracy (GVA). Measured in meters."},"geohash":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"Geohash of the geo-coordinates (latitude and longitude)."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Geohash"}},"children":[{"$$mdtype":"Node","attributes":{"content":"Geohashing"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" is a geocoding system used to encode geographic coordinates in decimal degrees, to a single string."},"children":[],"type":"text"}]},"horizontal_accuracy":{"type":"string","nullable":true,"description":"Provides quality/containment on horizontal position. This is based on ADS-B NACp. Measured in meters."},"is_on_premises":{"type":"boolean","nullable":true,"description":"Indicates whether the location is on-premises."},"isp":{"type":"string","nullable":true,"description":"The name of the Internet Service Provider (ISP)."},"lat":{"type":"number","format":"double","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The geographical Latitude coordinate represented in Decimal Degrees (DD). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"42.361145"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"long":{"type":"number","format":"double","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The geographical Longitude coordinate represented in Decimal Degrees (DD). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"-71.057083"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"postal_code":{"type":"string","nullable":true,"description":"The postal code of the location."},"pressure_altitude":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The uncorrected barometric pressure altitude (based on reference standard 29.92 inHg, 1013.25 mb) provides a reference for algorithms that utilize 'altitude deltas' between aircraft. This value is provided in meters and must have a minimum resolution of 1 m.. Special Values: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Invalid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"No Value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Unknown: -1000 m"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"provider":{"type":"string","nullable":true,"description":"The provider of the geographical location data."},"region":{"type":"string","nullable":true,"description":"The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. For example, 'CH-VD' for the Canton of Vaud, Switzerland"}}}},"components/schemas/ocsfv1.8.0Logger":{"id":"components/schemas/ocsfv1.8.0Logger","kind":"json-schema","title":"ocsfv1.8.0Logger","data":{"title":"ocsfv1.8.0Logger","type":"object","description":"The Logger object represents the device and product where events are stored with times for receipt and transmission.  This may be at the source device where the event occurred, a remote scanning device, intermediate hops, or the ultimate destination.","properties":{"device":{"$ref":"#/components/schemas/ocsfv1.8.0Device","nullable":true,"description":"The device where the events are logged."},"event_uid":{"type":"string","nullable":true,"description":"The unique identifier of the event assigned by the logger."},"is_truncated":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates whether the OCSF event data has been truncated due to size limitations. When "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", some event data may have been omitted to fit within system constraints."},"children":[],"type":"text"}],"type":"paragraph"}]},"log_format":{"type":"string","nullable":true,"description":"The format of data in the log. For example JSON, syslog or CSV."},"log_level":{"type":"string","nullable":true,"description":"The level at which an event was logged. This can be log provider specific. For example the audit level."},"log_name":{"type":"string","nullable":true,"description":"The log name for the logging provider log, or the file name of the system log. This may be an intermediate store-and-forward log or a vendor destination log. For example /archive/server1/var/log/messages.0 or /var/log/."},"log_provider":{"type":"string","nullable":true,"description":"The logging provider or logging service that logged the event. This may be an intermediate application store-and-forward log or a vendor destination log."},"log_version":{"type":"string","nullable":true,"description":"The event log schema version of the original event. For example the syslog version or the Cisco Log Schema version"},"logged_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The time when the logging system collected and logged the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different."},"children":[],"type":"text"}]},"logged_time_dt":{"type":"string","format":"date-time","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The time when the logging system collected and logged the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different."},"children":[],"type":"text"}]},"name":{"type":"string","nullable":true,"description":"The name of the logging product instance."},"product":{"$ref":"#/components/schemas/ocsfv1.8.0Product","nullable":true,"description":"The product logging the event.  This may be the event source product, a management server product, a scanning product, a SIEM, etc."},"transmit_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the event was transmitted from the logging device to it's next destination."},"transmit_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the event was transmitted from the logging device to it's next destination."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the logging product instance."},"untruncated_size":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The original size of the OCSF event data in kilobytes before any truncation occurred. This field is typically populated when "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"is_truncated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to indicate the full size of the original event."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":"The version of the logging provider."}}}},"components/schemas/ocsfv1.8.0LongString":{"id":"components/schemas/ocsfv1.8.0LongString","kind":"json-schema","title":"ocsfv1.8.0LongString","data":{"title":"ocsfv1.8.0LongString","type":"object","description":"This object is a used to capture strings which may be truncated by a security product due to their length.","properties":{"is_truncated":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" has been truncated. May be omitted if truncation has not occurred."},"children":[],"type":"text"}],"type":"paragraph"}]},"untruncated_size":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The size in bytes of the string represented by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" before truncation. Should be omitted if truncation has not occurred."},"children":[],"type":"text"}],"type":"paragraph"}]},"value":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The string value, truncated if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"is_truncated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["value"]}},"components/schemas/ocsfv1.8.0Malware":{"id":"components/schemas/ocsfv1.8.0Malware","kind":"json-schema","title":"ocsfv1.8.0Malware","data":{"title":"ocsfv1.8.0Malware","type":"object","description":"The Malware object describes the classification of known malicious software, which is intentionally designed to cause damage to a computer, server, client, or computer network.","properties":{"classification_ids":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware_ClassificationIds"},"description":"The list of normalized identifiers of the malware classifications."},"classifications":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of malware classifications, normalized to the captions of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"classification_ids"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" values. In the case of 'Other', they are defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"cves":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Cve"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of Common Vulnerabilities and Exposures (CVE) identifiers associated with the malware. Reference: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cve.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CVE"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"files":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0File"},"nullable":true,"description":"The list of file objects representing files that were identified as infected by the malware."},"name":{"type":"string","nullable":true,"description":"The malware name, as reported by the detection engine."},"num_infected":{"type":"integer","nullable":true,"description":"The number of files that were identified to be infected by the malware."},"path":{"$ref":"#/components/schemas/ocsfv1.8.0FilePath","nullable":true,"description":"The filesystem path of the malware that was observed."},"provider":{"type":"string","nullable":true,"description":"The name or identifier of the security solution or service that provided the malware detection information."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The severity of the malware, normalized to the captions of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" values. In the case of 'Other', they are defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0Malware_SeverityId","nullable":true,"description":"The normalized identifier of the malware severity."},"uid":{"type":"string","nullable":true,"description":"A unique identifier for the specific malware instance, as assigned by the detection engine (e.g., virus signature ID or IPS rule ID)."}},"required":["classification_ids"]}},"components/schemas/ocsfv1.8.0Malware_ClassificationIds":{"id":"components/schemas/ocsfv1.8.0Malware_ClassificationIds","kind":"json-schema","title":"ocsfv1.8.0Malware_ClassificationIds","data":{"title":"ocsfv1.8.0Malware_ClassificationIds","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MalwareClassificationIds is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The classification is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Adware"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Backdoor"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Bot"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Bootkit"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - DDOS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Downloader"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Dropper"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Kit"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Keylogger"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Ransomware"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Access_Trojan"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Exploitation"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Security_Software"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Rootkit"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - Capture"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Spyware"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Trojan"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Virus"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Webshell"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Wiper"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Worm"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The classification is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"classifications"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Malware_SeverityId":{"id":"components/schemas/ocsfv1.8.0Malware_SeverityId","kind":"json-schema","title":"ocsfv1.8.0Malware_SeverityId","data":{"title":"ocsfv1.8.0Malware_SeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MalwareSeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0MalwareScanInfo":{"id":"components/schemas/ocsfv1.8.0MalwareScanInfo","kind":"json-schema","title":"ocsfv1.8.0MalwareScanInfo","data":{"title":"ocsfv1.8.0MalwareScanInfo","type":"object","description":"The malware scan information object describes characteristics, metadata of a malware scanning job.","properties":{"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The timestamp indicating when the scan job completed execution."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp indicating when the scan job completed execution."},"name":{"type":"string","nullable":true,"description":"The administrator-supplied or application-generated name of the scan. For example: \"Home office weekly user database scan\", \"Scan folders for viruses\", \"Full system virus scan\""},"num_files":{"type":"integer","nullable":true,"description":"The total number of files analyzed during the scan."},"num_infected":{"type":"integer","nullable":true,"description":"The total number of files identified as infected with malware during the scan."},"num_volumes":{"type":"integer","nullable":true,"description":"The total number of storage volumes examined during the malware scan."},"size":{"type":"integer","nullable":true,"description":"The total size in bytes of all files that were scanned."},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The timestamp indicating when the scan job began execution."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp indicating when the scan job began execution."},"type":{"type":"string","nullable":true,"description":"The type of scan."},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo_TypeId","description":"The type id of the scan."},"uid":{"type":"string","nullable":true,"description":"The application-defined unique identifier assigned to an instance of a scan."},"unique_malware_count":{"type":"integer","nullable":true,"description":"The number of unique malware detected across all infected files."}},"required":["type_id"]}},"components/schemas/ocsfv1.8.0MalwareScanInfo_TypeId":{"id":"components/schemas/ocsfv1.8.0MalwareScanInfo_TypeId","kind":"json-schema","title":"ocsfv1.8.0MalwareScanInfo_TypeId","data":{"title":"ocsfv1.8.0MalwareScanInfo_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MalwareScanInfoTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Manual: The scan was manually initiated by the user or administrator."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Scheduled: The scan was started based on scheduler."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - UpdatedContent: The scan was triggered by a content update."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - QuarantinedItems: The scan was triggered by newly quarantined items."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - AttachedMedia: The scan was triggered by the attachment of removable media."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - UserLogon: The scan was started due to a user logon."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - ELAM: The scan was triggered by an Early Launch Anti-Malware (ELAM) detection."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The scan type id is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Metadata":{"id":"components/schemas/ocsfv1.8.0Metadata","kind":"json-schema","title":"ocsfv1.8.0Metadata","data":{"title":"ocsfv1.8.0Metadata","type":"object","description":"The Metadata object describes the metadata associated with the event.","properties":{"correlation_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A unique identifier used to correlate this OCSF event with other related OCSF events, distinct from the event's "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. This enables linking multiple OCSF events that are part of the same activity, transaction, or security incident across different systems or time periods."},"children":[],"type":"text"}],"type":"paragraph"}]},"debug":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Debug information about non-fatal issues with this OCSF event. Each issue is a line in this string array."},"event_code":{"type":"string","nullable":true,"description":"The identifier of the original event. For example the numerical Windows Event Code or Cisco syslog code."},"extension":{"$ref":"#/components/schemas/ocsfv1.8.0Extension","nullable":true,"description":"The schema extension used to create the event."},"extensions":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Extension"},"nullable":true,"description":"The schema extensions used to create the event."},"is_truncated":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates whether the OCSF event data has been truncated due to size limitations. When "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", some event data may have been omitted to fit within system constraints."},"children":[],"type":"text"}],"type":"paragraph"}]},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of labels attached to the event. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[\"sample\", \"dev\"]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"log_format":{"type":"string","nullable":true,"description":"The format of data in the log where the data originated. For example CSV, XML, Windows Multiline, JSON, syslog or Cisco Log Schema."},"log_level":{"type":"string","nullable":true,"description":"The level at which an event was logged. This can be log provider specific. For example the audit level."},"log_name":{"type":"string","nullable":true,"description":"The event log name, typically for the consumer of the event. For example, the storage bucket name, SIEM repository index name, etc."},"log_provider":{"type":"string","nullable":true,"description":"The logging provider or logging service that logged the event. For example AWS CloudWatch or Splunk."},"log_source":{"type":"string","nullable":true,"description":"The log system or component where the data originated. For example, a file path, syslog server name or a Windows hostname and logging subsystem such as Security."},"log_version":{"type":"string","nullable":true,"description":"The event log schema version of the original event. For example the syslog version or the Cisco Log Schema version"},"logged_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The time when the logging system collected and logged the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different."},"children":[],"type":"text"}]},"logged_time_dt":{"type":"string","format":"date-time","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The time when the logging system collected and logged the event."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different."},"children":[],"type":"text"}]},"loggers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Logger"},"nullable":true,"description":"An array of Logger objects that describe the pipeline of devices and logging products between the event source and its eventual destination. Note, this attribute can be used when there is a complex end-to-end path of event flow and/or to track the chain of custody of the data."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the event was last modified or enriched."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the event was last modified or enriched."},"original_event_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier assigned to the event in its original logging system before transformation to OCSF format. This field preserves the source system's native event identifier, enabling traceability back to the raw log entry. For example, a Windows Event Record ID, a syslog message ID, a Splunk _cd value, or a database transaction log sequence number."},"children":[],"type":"text"}],"type":"paragraph"}]},"original_time":{"type":"string","nullable":true,"description":"The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs."},"processed_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The event processed time, such as an ETL operation."},"processed_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The event processed time, such as an ETL operation."},"product":{"$ref":"#/components/schemas/ocsfv1.8.0Product","description":"The product that reported the event."},"profiles":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of profiles used to create the event.  Profiles should be referenced by their "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for core profiles, or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"extension/name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for profiles from extensions."},"children":[],"type":"text"}],"type":"paragraph"}]},"reporter":{"$ref":"#/components/schemas/ocsfv1.8.0Reporter","nullable":true,"description":"The entity from which the event or finding was first reported."},"sequence":{"type":"integer","nullable":true,"description":"Sequence number of the event. The sequence number is a value available in some events, to make the exact ordering of events unambiguous, regardless of the event time precision."},"source":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The source of the event or finding. This can be any distinguishing name for the logical origin of the data — for example, 'CloudTrail Events', or a use case like 'Attack Simulations' or 'Vulnerability Scans'."},"children":[],"type":"text"}],"type":"paragraph"}]},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the event."},"children":[],"type":"text"}],"type":"paragraph"}]},"tenant_uid":{"type":"string","nullable":true,"description":"The unique tenant identifier."},"total_queued_duration":{"$ref":"#/components/schemas/ocsfv1.8.0Timespan","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The amount of time an event spent in a queue awaiting processing. In this case, the value is the difference between "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"processed_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"logged_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". This duration is inclusive of all queues between the originator of the event and the intended long-term storage destination of the event."},"children":[],"type":"text"}],"type":"paragraph"}]},"transformation_info_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0TransformationInfo"},"nullable":true,"description":"An array of transformation info that describes the mappings or transforms applied to the data."},"transmit_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the event was transmitted from the logging device to it's next destination."},"transmit_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the event was transmitted from the logging device to it's next destination."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of the event or finding as a subset of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"source"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event. This can be any distinguishing characteristic of the data. For example 'Management Events' or 'Device Penetration Test'."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A unique identifier assigned to the OCSF event. This ID is specific to the OCSF event itself and is distinct from the original event identifier in the source system (see "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"original_event_uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":")."},"children":[],"type":"text"}],"type":"paragraph"}]},"untruncated_size":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The original size of the OCSF event data in kilobytes before any truncation occurred. This field is typically populated when "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"is_truncated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to indicate the full size of the original event."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The version of the OCSF schema, using Semantic Versioning Specification ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://semver.org"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SemVer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.0.0."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" Event consumers use the version to determine the available event attributes."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["product","version"]}},"components/schemas/ocsfv1.8.0Metric":{"id":"components/schemas/ocsfv1.8.0Metric","kind":"json-schema","title":"ocsfv1.8.0Metric","data":{"title":"ocsfv1.8.0Metric","type":"object","description":"The Metric object defines a simple name/value pair entity for a metric.","properties":{"name":{"type":"string","description":"The name of the metric."},"value":{"type":"string","description":"The value of the metric."}},"required":["name","value"]}},"components/schemas/ocsfv1.8.0Mitigation":{"id":"components/schemas/ocsfv1.8.0Mitigation","kind":"json-schema","title":"ocsfv1.8.0Mitigation","data":{"title":"ocsfv1.8.0Mitigation","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE Mitigation object describes the ATT&CK® or ATLAS™ Mitigation ID and/or name that is associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"countermeasures":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0D3fend"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The D3FEND countermeasures that are associated with the attack technique. For example: ATT&CK Technique "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"T1003"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is addressed by Mitigation "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"M1027"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", and D3FEND Technique "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"D3-OTP"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Mitigation name that is associated with the attack technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Password Policies"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Code Signing"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The versioned permalink of the Mitigation. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://attack.mitre.org/versions/v14/mitigations/M1027"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Mitigation ID that is associated with the attack technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"M1027"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AML.M0013"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0NetworkConnectionInfo":{"id":"components/schemas/ocsfv1.8.0NetworkConnectionInfo","kind":"json-schema","title":"ocsfv1.8.0NetworkConnectionInfo","data":{"title":"ocsfv1.8.0NetworkConnectionInfo","type":"object","description":"The Network Connection Information object describes characteristics of an OSI Transport Layer communication, including TCP and UDP.","properties":{"boundary":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The boundary of the connection, normalized to the caption of 'boundary_id'. In the case of 'Other', it is defined by the event source. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" For cloud connections, this translates to the traffic-boundary(same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"boundary_id":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkConnectionInfo_BoundaryId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the boundary of the connection. "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":" For cloud connections, this translates to the traffic-boundary (same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External."},"children":[],"type":"text"}],"type":"tag","tag":"html"}]},"community_uid":{"type":"string","nullable":true,"description":"The Community ID of the network connection."},"direction":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The direction of the initiated connection, traffic, or email, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"direction_id":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkConnectionInfo_DirectionId","description":"The normalized identifier of the direction of the initiated connection, traffic, or email."},"flag_history":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Connection Flag History summarizes events in a network connection. For example flags "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" ShAD "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" representing SYN, SYN/ACK, ACK and Data exchange."},"children":[],"type":"text"}],"type":"paragraph"}]},"protocol_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The IP protocol name in lowercase, as defined by the Internet Assigned Numbers Authority (IANA). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tcp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"udp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"protocol_num":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The IP protocol number, as defined by the Internet Assigned Numbers Authority (IANA). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"6"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for TCP and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"17"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for UDP."},"children":[],"type":"text"}],"type":"paragraph"}]},"protocol_ver":{"type":"string","nullable":true,"description":"The Internet Protocol version."},"protocol_ver_id":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkConnectionInfo_ProtocolVerId","nullable":true,"description":"The Internet Protocol version identifier."},"session":{"$ref":"#/components/schemas/ocsfv1.8.0Session","nullable":true,"description":"The authenticated user or service session."},"tcp_flags":{"type":"integer","nullable":true,"description":"The network connection TCP header flags (i.e., control bits)."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the connection."}},"required":["direction_id"]}},"components/schemas/ocsfv1.8.0NetworkConnectionInfo_BoundaryId":{"id":"components/schemas/ocsfv1.8.0NetworkConnectionInfo_BoundaryId","kind":"json-schema","title":"ocsfv1.8.0NetworkConnectionInfo_BoundaryId","data":{"title":"ocsfv1.8.0NetworkConnectionInfo_BoundaryId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkConnectionInfoBoundaryId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The connection boundary is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Localhost: Local network traffic on the same endpoint."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Internal: Internal network traffic between two endpoints inside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - External: External network traffic between two endpoints on the Internet or outside the network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - SameVPC: Through another resource in the same VPC"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - VPCGateway: Through an Internet gateway or a gateway VPC endpoint"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - VirtualPrivateGateway: Through a virtual private gateway"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - regionVPC: Through an intra-region VPC peering connection"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - regionVPC: Through an inter-region VPC peering connection"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - LocalGateway: Through a local gateway"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - GatewayVPC: Through a gateway VPC endpoint (Nitro-based instances only)"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - InternetGateway: Through an Internet gateway (Nitro-based instances only)"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The boundary is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"boundary"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0NetworkConnectionInfo_DirectionId":{"id":"components/schemas/ocsfv1.8.0NetworkConnectionInfo_DirectionId","kind":"json-schema","title":"ocsfv1.8.0NetworkConnectionInfo_DirectionId","data":{"title":"ocsfv1.8.0NetworkConnectionInfo_DirectionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkConnectionInfoDirectionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The connection direction is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Inbound: Inbound network connection. The connection originated from the Internet or outside network, destined for services on the inside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Outbound: Outbound network connection. The connection originated from inside the network, destined for services on the Internet or outside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Lateral: Lateral network connection. The connection originated from inside the network, destined for services on the inside network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Local: Local network connection ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"localhost"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"). The connection is intra-device, originating from and destined for services running on the same device."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The direction is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"direction"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0NetworkConnectionInfo_ProtocolVerId":{"id":"components/schemas/ocsfv1.8.0NetworkConnectionInfo_ProtocolVerId","kind":"json-schema","title":"ocsfv1.8.0NetworkConnectionInfo_ProtocolVerId","data":{"title":"ocsfv1.8.0NetworkConnectionInfo_ProtocolVerId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkConnectionInfoProtocolVerId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The protocol version is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - IPv4_"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - IPv6_"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The protocol version is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"protocol_ver"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0NetworkEndpoint":{"id":"components/schemas/ocsfv1.8.0NetworkEndpoint","kind":"json-schema","title":"ocsfv1.8.0NetworkEndpoint","data":{"title":"ocsfv1.8.0NetworkEndpoint","type":"object","description":"The Network Endpoint object describes characteristics of a network endpoint. These can be a source or destination of a network connection.","properties":{"agent_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Agent"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"agent"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects associated with a device, endpoint, or resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"autonomous_system":{"$ref":"#/components/schemas/ocsfv1.8.0AutonomousSystem","nullable":true,"description":"The Autonomous System details associated with an IP address."},"domain":{"type":"string","nullable":true,"description":"The name of the domain that the endpoint belongs to or that corresponds to the endpoint."},"fingerprints":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint"},"nullable":true,"description":"Fingerprints that identify the specific application implementation on this endpoint, such as Cisco NPF or HASSH."},"hostname":{"$ref":"#/components/schemas/ocsfv1.8.0Hostname","nullable":true,"description":"The fully qualified name of the endpoint."},"hw_info":{"$ref":"#/components/schemas/ocsfv1.8.0DeviceHwInfo","nullable":true,"description":"The endpoint hardware information."},"instance_uid":{"type":"string","nullable":true,"description":"The unique identifier of a VM instance."},"interface_name":{"type":"string","nullable":true,"description":"The name of the network interface (e.g. eth2)."},"interface_uid":{"type":"string","nullable":true,"description":"The unique identifier of the network interface."},"intermediate_ips":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0IPAddress"},"nullable":true,"description":"The intermediate IP Addresses. For example, the IP addresses in the HTTP X-Forwarded-For header."},"ip":{"$ref":"#/components/schemas/ocsfv1.8.0IPAddress","nullable":true,"description":"The IP address of the endpoint, in either IPv4 or IPv6 format."},"isp":{"type":"string","nullable":true,"description":"The name of the Internet Service Provider (ISP)."},"isp_org":{"type":"string","nullable":true,"description":"The organization name of the Internet Service Provider (ISP). This represents the parent organization or company that owns/operates the ISP. For example, Comcast Corporation would be the ISP org for Xfinity internet service. This attribute helps identify the ultimate provider when ISPs operate under different brand names."},"location":{"$ref":"#/components/schemas/ocsfv1.8.0Location","nullable":true,"description":"The geographical location of the endpoint."},"mac":{"$ref":"#/components/schemas/ocsfv1.8.0MACAddress","nullable":true,"description":"The Media Access Control (MAC) address of the endpoint."},"mac_vendor":{"type":"string","nullable":true,"description":"The vendor or manufacturer of the endpoint's network interface controller (NIC), as identified from the MAC address."},"name":{"type":"string","nullable":true,"description":"The short name of the endpoint."},"network_scope":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates whether the endpoint resides inside the customer’s network, outside on the Internet, or if its location relative to the customer’s network cannot be determined. The value is normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"network_scope_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"network_scope_id":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint_NetworkScopeId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized identifier of the endpoint’s network scope. The normalized network scope identifier indicates whether the endpoint resides inside the customer’s network, outside on the Internet, or if its location relative to the customer’s network cannot be determined."},"children":[],"type":"text"}],"type":"paragraph"}]},"os":{"$ref":"#/components/schemas/ocsfv1.8.0Os","nullable":true,"description":"The endpoint operating system."},"owner":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The identity of the service or user account that owns the endpoint or was last logged into it."},"pool":{"$ref":"#/components/schemas/ocsfv1.8.0Group","nullable":true,"description":"The pool of desktops or virtual machines to which the endpoint belongs."},"port":{"$ref":"#/components/schemas/ocsfv1.8.0Port","nullable":true,"description":"The port used for communication within the network connection."},"proxy_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkProxy","nullable":true,"description":"The network proxy information pertaining to a specific endpoint. This can be used to describe information pertaining to network address translation (NAT)."},"subnet_uid":{"type":"string","nullable":true,"description":"The unique identifier of a virtual subnet."},"svc_name":{"type":"string","nullable":true,"description":"The service name in service-to-service connections. For example, AWS VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields identify the connection is coming from or going to an AWS service."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network endpoint type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"unknown"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkEndpoint_TypeId","nullable":true,"description":"The network endpoint type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the endpoint."},"vlan_uid":{"type":"string","nullable":true,"description":"The Virtual LAN identifier."},"vpc_uid":{"type":"string","nullable":true,"description":"The unique identifier of the Virtual Private Cloud (VPC)."},"zone":{"type":"string","nullable":true,"description":"The network zone or LAN segment."}}}},"components/schemas/ocsfv1.8.0NetworkEndpoint_NetworkScopeId":{"id":"components/schemas/ocsfv1.8.0NetworkEndpoint_NetworkScopeId","kind":"json-schema","title":"ocsfv1.8.0NetworkEndpoint_NetworkScopeId","data":{"title":"ocsfv1.8.0NetworkEndpoint_NetworkScopeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkEndpointNetworkScopeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: Unknown whether this endpoint resides within the customer’s network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Internal: The endpoint resides inside the customer’s network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - External: The endpoint is on the Internet or otherwise external to the customer’s network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The network scope is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"network_scope"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0NetworkEndpoint_TypeId":{"id":"components/schemas/ocsfv1.8.0NetworkEndpoint_TypeId","kind":"json-schema","title":"ocsfv1.8.0NetworkEndpoint_TypeId","data":{"title":"ocsfv1.8.0NetworkEndpoint_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkEndpointTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Server: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Server/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Desktop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Laptop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Tablet: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Mobile: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile phone"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Virtual: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual machine"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - IOT: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.techtarget.com/iotagenda/definition/IoT-device"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IOT (Internet of Things) device"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Browser: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Browser/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"web browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Firewall: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Firewall/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking firewall"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Switch: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Switch/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking switch"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Hub: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Ethernet_hub"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking hub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - Router: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Router/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking router"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - IDS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion detection system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - IPS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion prevention system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - LoadBalancer: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Load_balancing_(computing)"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Load Balancer device."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0NetworkInterface":{"id":"components/schemas/ocsfv1.8.0NetworkInterface","kind":"json-schema","title":"ocsfv1.8.0NetworkInterface","data":{"title":"ocsfv1.8.0NetworkInterface","type":"object","description":"The Network Interface object describes the type and associated attributes of a physical or virtual network interface.","properties":{"hostname":{"$ref":"#/components/schemas/ocsfv1.8.0Hostname","nullable":true,"description":"The hostname associated with the network interface."},"ip":{"$ref":"#/components/schemas/ocsfv1.8.0IPAddress","nullable":true,"description":"The IP address associated with the network interface."},"mac":{"$ref":"#/components/schemas/ocsfv1.8.0MACAddress","nullable":true,"description":"The MAC address of the network interface."},"name":{"type":"string","nullable":true,"description":"The name of the network interface."},"namespace":{"type":"string","nullable":true,"description":"The namespace is useful in merger or acquisition situations. For example, when similar entities exist that you need to keep separate."},"open_ports":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0PortInfo"},"nullable":true,"description":"The list of open ports on a network interface, including port numbers and associated protocol information."},"subnet_prefix":{"type":"integer","nullable":true,"description":"The subnet prefix length determines the number of bits used to represent the network part of the IP address. The remaining bits are reserved for identifying individual hosts within that subnet."},"type":{"type":"string","nullable":true,"description":"The type of network interface."},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkInterface_TypeId","nullable":true,"description":"The network interface type identifier."},"uid":{"type":"string","nullable":true,"description":"The unique identifier for the network interface."}}}},"components/schemas/ocsfv1.8.0NetworkInterface_TypeId":{"id":"components/schemas/ocsfv1.8.0NetworkInterface_TypeId","kind":"json-schema","title":"ocsfv1.8.0NetworkInterface_TypeId","data":{"title":"ocsfv1.8.0NetworkInterface_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkInterfaceTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Wired"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Wireless"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Mobile"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Tunnel"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0NetworkProxy":{"id":"components/schemas/ocsfv1.8.0NetworkProxy","kind":"json-schema","title":"ocsfv1.8.0NetworkProxy","data":{"title":"ocsfv1.8.0NetworkProxy","type":"object","description":"The network proxy endpoint object describes a proxy server, which acts as an intermediary between a client requesting a resource and the server providing that resource.","properties":{"agent_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Agent"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"agent"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects associated with a device, endpoint, or resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"autonomous_system":{"$ref":"#/components/schemas/ocsfv1.8.0AutonomousSystem","nullable":true,"description":"The Autonomous System details associated with an IP address."},"domain":{"type":"string","nullable":true,"description":"The name of the domain that the endpoint belongs to or that corresponds to the endpoint."},"fingerprints":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint"},"nullable":true,"description":"Fingerprints that identify the specific application implementation on this endpoint, such as Cisco NPF or HASSH."},"hostname":{"$ref":"#/components/schemas/ocsfv1.8.0Hostname","nullable":true,"description":"The fully qualified name of the endpoint."},"hw_info":{"$ref":"#/components/schemas/ocsfv1.8.0DeviceHwInfo","nullable":true,"description":"The endpoint hardware information."},"instance_uid":{"type":"string","nullable":true,"description":"The unique identifier of a VM instance."},"interface_name":{"type":"string","nullable":true,"description":"The name of the network interface (e.g. eth2)."},"interface_uid":{"type":"string","nullable":true,"description":"The unique identifier of the network interface."},"intermediate_ips":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0IPAddress"},"nullable":true,"description":"The intermediate IP Addresses. For example, the IP addresses in the HTTP X-Forwarded-For header."},"ip":{"$ref":"#/components/schemas/ocsfv1.8.0IPAddress","nullable":true,"description":"The IP address of the endpoint, in either IPv4 or IPv6 format."},"isp":{"type":"string","nullable":true,"description":"The name of the Internet Service Provider (ISP)."},"isp_org":{"type":"string","nullable":true,"description":"The organization name of the Internet Service Provider (ISP). This represents the parent organization or company that owns/operates the ISP. For example, Comcast Corporation would be the ISP org for Xfinity internet service. This attribute helps identify the ultimate provider when ISPs operate under different brand names."},"location":{"$ref":"#/components/schemas/ocsfv1.8.0Location","nullable":true,"description":"The geographical location of the endpoint."},"mac":{"$ref":"#/components/schemas/ocsfv1.8.0MACAddress","nullable":true,"description":"The Media Access Control (MAC) address of the endpoint."},"mac_vendor":{"type":"string","nullable":true,"description":"The vendor or manufacturer of the endpoint's network interface controller (NIC), as identified from the MAC address."},"name":{"type":"string","nullable":true,"description":"The short name of the endpoint."},"network_scope":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates whether the endpoint resides inside the customer’s network, outside on the Internet, or if its location relative to the customer’s network cannot be determined. The value is normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"network_scope_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"network_scope_id":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkProxy_NetworkScopeId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized identifier of the endpoint’s network scope. The normalized network scope identifier indicates whether the endpoint resides inside the customer’s network, outside on the Internet, or if its location relative to the customer’s network cannot be determined."},"children":[],"type":"text"}],"type":"paragraph"}]},"os":{"$ref":"#/components/schemas/ocsfv1.8.0Os","nullable":true,"description":"The endpoint operating system."},"owner":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The identity of the service or user account that owns the endpoint or was last logged into it."},"pool":{"$ref":"#/components/schemas/ocsfv1.8.0Group","nullable":true,"description":"The pool of desktops or virtual machines to which the endpoint belongs."},"port":{"$ref":"#/components/schemas/ocsfv1.8.0Port","nullable":true,"description":"The port used for communication within the network connection."},"proxy_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The network proxy information pertaining to a specific endpoint. This can be used to describe information pertaining to network address translation (NAT)."},"subnet_uid":{"type":"string","nullable":true,"description":"The unique identifier of a virtual subnet."},"svc_name":{"type":"string","nullable":true,"description":"The service name in service-to-service connections. For example, AWS VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields identify the connection is coming from or going to an AWS service."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The network endpoint type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"unknown"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0NetworkProxy_TypeId","nullable":true,"description":"The network endpoint type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the endpoint."},"vlan_uid":{"type":"string","nullable":true,"description":"The Virtual LAN identifier."},"vpc_uid":{"type":"string","nullable":true,"description":"The unique identifier of the Virtual Private Cloud (VPC)."},"zone":{"type":"string","nullable":true,"description":"The network zone or LAN segment."}}}},"components/schemas/ocsfv1.8.0NetworkProxy_NetworkScopeId":{"id":"components/schemas/ocsfv1.8.0NetworkProxy_NetworkScopeId","kind":"json-schema","title":"ocsfv1.8.0NetworkProxy_NetworkScopeId","data":{"title":"ocsfv1.8.0NetworkProxy_NetworkScopeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkProxyNetworkScopeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: Unknown whether this endpoint resides within the customer’s network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Internal: The endpoint resides inside the customer’s network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - External: The endpoint is on the Internet or otherwise external to the customer’s network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The network scope is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"network_scope"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0NetworkProxy_TypeId":{"id":"components/schemas/ocsfv1.8.0NetworkProxy_TypeId","kind":"json-schema","title":"ocsfv1.8.0NetworkProxy_TypeId","data":{"title":"ocsfv1.8.0NetworkProxy_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NetworkProxyTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Server: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Server/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"server"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Desktop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"desktop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Laptop: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"laptop computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Tablet: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tablet computer"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Mobile: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mobile phone"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Virtual: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"virtual machine"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - IOT: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.techtarget.com/iotagenda/definition/IoT-device"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"IOT (Internet of Things) device"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Browser: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Browser/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"web browser"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Firewall: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Firewall/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking firewall"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Switch: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Switch/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking switch"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Hub: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Ethernet_hub"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking hub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - Router: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:Router/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"networking router"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - IDS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion detection system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - IPS: An "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"intrusion prevention system"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - LoadBalancer: A "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/Load_balancing_(computing)"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Load Balancer device."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0NetworkTraffic":{"id":"components/schemas/ocsfv1.8.0NetworkTraffic","kind":"json-schema","title":"ocsfv1.8.0NetworkTraffic","data":{"title":"ocsfv1.8.0NetworkTraffic","type":"object","description":"The Network Traffic object describes characteristics of network traffic over a time period. The metrics represent network data transferred between source and destination during an observation window.","properties":{"bytes":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The total number of bytes transferred in both directions (sum of bytes_in and bytes_out)."},"children":[],"type":"text"}],"type":"paragraph"}]},"bytes_in":{"type":"integer","nullable":true,"description":"The number of bytes sent from the destination to the source (inbound direction)."},"bytes_missed":{"type":"integer","nullable":true,"description":"The number of bytes that were missed during observation, typically due to packet loss or sampling limitations."},"bytes_out":{"type":"integer","nullable":true,"description":"The number of bytes sent from the source to the destination (outbound direction)."},"chunks":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The total number of chunks transferred in both directions (sum of chunks_in and chunks_out)."},"children":[],"type":"text"}],"type":"paragraph"}]},"chunks_in":{"type":"integer","nullable":true,"description":"The number of chunks sent from the destination to the source (inbound direction)."},"chunks_out":{"type":"integer","nullable":true,"description":"The number of chunks sent from the source to the destination (outbound direction)."},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of the observation or reporting period."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of the observation or reporting period."},"packets":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The total number of packets transferred in both directions (sum of packets_in and packets_out)."},"children":[],"type":"text"}],"type":"paragraph"}]},"packets_in":{"type":"integer","nullable":true,"description":"The number of packets sent from the destination to the source (inbound direction)."},"packets_out":{"type":"integer","nullable":true,"description":"The number of packets sent from the source to the destination (outbound direction)."},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of the observation or reporting period."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of the observation or reporting period."},"timespan":{"$ref":"#/components/schemas/ocsfv1.8.0Timespan","nullable":true,"description":"The time span object representing the duration of the observation or reporting period."}}}},"components/schemas/ocsfv1.8.0Node":{"id":"components/schemas/ocsfv1.8.0Node","kind":"json-schema","title":"ocsfv1.8.0Node","data":{"title":"ocsfv1.8.0Node","type":"object","description":"Represents a node or a vertex in a graph structure.","properties":{"data":{"nullable":true,"description":"Additional data about the node stored as key-value pairs. Can include custom properties specific to the node."},"desc":{"type":"string","nullable":true,"description":"A human-readable description of the node's purpose or meaning in the graph."},"name":{"type":"string","nullable":true,"description":"A human-readable name or label for the node. Should be descriptive and unique within the graph context."},"type":{"type":"string","nullable":true,"description":"Categorizes the node into a specific class or type. Useful for grouping and filtering nodes."},"uid":{"type":"string","description":"A unique string or numeric identifier that distinguishes this node from all others in the graph. Must be unique across all nodes."}},"required":["uid"]}},"components/schemas/ocsfv1.8.0Object":{"id":"components/schemas/ocsfv1.8.0Object","kind":"json-schema","title":"ocsfv1.8.0Object","data":{"title":"ocsfv1.8.0Object","type":"object","additionalProperties":true,"description":"An unordered collection of attributes. It defines a set of attributes available in all objects. It can be also used as a generic object to log objects that are not otherwise defined by the schema."}},"components/schemas/ocsfv1.8.0Observable":{"id":"components/schemas/ocsfv1.8.0Observable","kind":"json-schema","title":"ocsfv1.8.0Observable","data":{"title":"ocsfv1.8.0Observable","type":"object","description":"The observable object is a pivot element that contains related information found in many places in the event.","properties":{"event_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"metadata.uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") of the source OCSF event from which this observable was extracted. This field enables linking observables back to their originating event data when observables are stored in a separate location or system."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full name of the observable attribute. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is a pointer/reference to an attribute within the OCSF event data. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"file.name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Array attributes may be represented in one of three ways. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"resources.uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"resources[].uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"resources[0].uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"reputation":{"$ref":"#/components/schemas/ocsfv1.8.0Reputation","nullable":true,"description":"Contains the original and normalized reputation scores."},"type":{"type":"string","nullable":true,"description":"The observable value type name."},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Observable_TypeId","description":"The observable value type identifier."},"type_uid":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The OCSF event type UID ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") of the source event that this observable was extracted from. This field enables filtering and categorizing observables by their originating event type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"300101"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for Network Activity (class_uid 3001) with activity_id 1."},"children":[],"type":"text"}],"type":"paragraph"}]},"value":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The value associated with the observable attribute. The meaning of the value depends on the observable type."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" refers to a scalar attribute, then the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is the value of the attribute."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" refers to an object attribute, then the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is not populated."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["type_id"]}},"components/schemas/ocsfv1.8.0Observable_TypeId":{"id":"components/schemas/ocsfv1.8.0Observable_TypeId","kind":"json-schema","title":"ocsfv1.8.0Observable_TypeId","data":{"title":"ocsfv1.8.0Observable_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ObservableTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: Unknown observable data type."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Hostname: Unique name assigned to a device connected to a computer network. It may be a fully qualified domain name (FQDN). For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"r2-d2.example.com."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":","},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"mx.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or IPv6 format. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"192.168.200.24"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2001:0db8:85a3:0000:0000:8a2e:0370:7334"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - MACAddress: Media Access Control (MAC) address. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"18:36:F3:98:4F:9A"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - UserName: User name. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"john_doe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - EmailAddress: Email address. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"john_doe@example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - URLString: Uniform Resource Locator (URL) string. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http://www.example.com/download/trouble.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - FileName: File name. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"text-file.txt"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Hash: Fingerprint. A value, in any format, that maps an arbitrarily large data item to a much shorter string that uniquely identifies the original data. Examples include cryptographic hashing of a file, code signing, and Network Protocol Fingerprinting (NPF)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note about name."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" The type name "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"file_hast_t"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and the caption \"Hash\" are used for legacy reasons. This type has been generalized from a file hash to a general fingerprint. The existing type name and caption were retained for backwards compatibility."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - ProcessName: Process name. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notepad"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - ResourceUID: Resource unique identifier. For example, S3 Bucket name or EC2 Instance ID."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Port: The TCP/UDP port number. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"80"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":","},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"22"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - Subnet: The subnet represented in a CIDR notation, using the format network_address/prefix_length. The network_address can be in either IPv4 or IPv6 format. The prefix length indicates the number of bits used for the network portion, and the remaining bits are available for host addresses within that subnet. For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"192.168.1.0/24"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":","},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2001:0db8:85a3:0000::/64"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Endpoint: The Endpoint object describes a physical or virtual device that connects to and exchanges information with a computer network. Some examples of endpoints are mobile devices, desktop computers, virtual machines, embedded devices, and servers. Internet-of-Things devices—like cameras, lighting, refrigerators, security systems, smart speakers, and thermostats—are also endpoints."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - User: The User object describes the characteristics of a user/person or a security principal."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Email: The Email object describes the email metadata such as sender, recipients, and direction, and can include embedded URLs and files."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - UniformResourceLocator: The Uniform Resource Locator (URL) object describes the characteristics of a URL."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - File: The File object represents the metadata associated with a file stored in a computer system. It encompasses information about the file itself, including its attributes, properties, and organizational details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Process: The Process object describes a running instance of a launched program."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - GeoLocation: The Geo Location object describes a geographical location, usually associated with an IP address."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Container: The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"30 - Fingerprint: The Fingerprint object provides detailed information about a fingerprint, which is a compact representation of data used to identify a longer piece of information, such as a public key, file content, or application implementation. It contains the algorithm or scheme and value of the fingerprint, enabling efficient and reliable identification of the associated data."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"45 - FilePath: The full path to the file. For example: For example:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"c:\\windows\\system32\\svchost.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The observable data type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which may contain data source specific value."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Observation":{"id":"components/schemas/ocsfv1.8.0Observation","kind":"json-schema","title":"ocsfv1.8.0Observation","data":{"title":"ocsfv1.8.0Observation","type":"object","description":"A record of an observed value or event that captures the timing and frequency of its occurrence. Used to track when values/events were first detected, last detected, and their total occurrence count.","properties":{"count":{"type":"integer","nullable":true,"description":"Integer representing the total number of times this specific value/event was observed across all occurrences. Helps establish prevalence and patterns."},"timespan":{"$ref":"#/components/schemas/ocsfv1.8.0Timespan","nullable":true,"description":"The time window when the value or event was first observed. It is used to analyze activity patterns, detect trends, or correlate events within a specific timeframe."},"value":{"type":"string","description":"The specific value, event, indicator or data point that was observed and recorded. This is the core piece of information being tracked."}},"required":["value"]}},"components/schemas/ocsfv1.8.0Organization":{"id":"components/schemas/ocsfv1.8.0Organization","kind":"json-schema","title":"ocsfv1.8.0Organization","data":{"title":"ocsfv1.8.0Organization","type":"object","description":"The Organization object describes characteristics of an organization or company and its division if any. Additionally, it also describes cloud and Software-as-a-Service (SaaS) logical hierarchies such as AWS Organizations, Google Cloud Organizations, Oracle Cloud Tenancies, and similar constructs.","properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the organization, Oracle Cloud Tenancy, Google Cloud Organization, or AWS Organization. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Widget, Inc. "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" AWS Organization name "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"ou_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of an organizational unit, Google Cloud Folder, or AWS Org Unit. For example, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" GCP Project Name "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Dev_Prod_OU "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"ou_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of an organizational unit, Google Cloud Folder, or AWS Org Unit. For example, an  "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Oracle Cloud Tenancy ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" AWS OU ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" GCP Folder ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the organization, Oracle Cloud Tenancy, Google Cloud Organization, or AWS Organization. For example, an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" AWS Org ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" Oracle Cloud Domain ID "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0Os":{"id":"components/schemas/ocsfv1.8.0Os","kind":"json-schema","title":"ocsfv1.8.0Os","data":{"title":"ocsfv1.8.0Os","type":"object","description":"The Operating System (OS) object describes characteristics of an OS, such as Linux or Windows.","properties":{"build":{"type":"string","nullable":true,"description":"The operating system build number."},"country":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The operating system country code, as defined by the ISO 3166-1 standard (Alpha-2 code)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"b","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" The two letter country code should be capitalized. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"US"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"CA"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"cpe_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Platform Enumeration (CPE) name as described by ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://nvd.nist.gov/products/cpe"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpe:/a:apple:safari:16.2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpu_bits":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The cpu architecture, the number of bits used for addressing in memory. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"32"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"64"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"edition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The operating system edition. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Professional"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"kernel_release":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The kernel release of the operating system. On Unix-based systems, this is determined from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"uname -r"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" command output, for example \"5.15.0-122-generic\"."},"children":[],"type":"text"}],"type":"paragraph"}]},"lang":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The two letter lower case language codes, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/ISO_639-1"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ISO 639-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"en"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (English), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"de"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (German), or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"fr"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (French)."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","description":"The operating system name."},"sp_name":{"type":"string","nullable":true,"description":"The name of the latest Service Pack."},"sp_ver":{"type":"integer","nullable":true,"description":"The version number of the latest Service Pack."},"type":{"type":"string","nullable":true,"description":"The type of the operating system."},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Os_TypeId","description":"The type identifier of the operating system."},"version":{"type":"string","nullable":true,"description":"The version of the OS running on the device that originated the event. For example: \"Windows 10\", \"OS X 10.7\", or \"iOS 9\"."}},"required":["name","type_id"]}},"components/schemas/ocsfv1.8.0Os_TypeId":{"id":"components/schemas/ocsfv1.8.0Os_TypeId","kind":"json-schema","title":"ocsfv1.8.0Os_TypeId","data":{"title":"ocsfv1.8.0Os_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OsTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"100 - Windows"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"101 - WindowsMobile"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"200 - Linux"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"201 - Android"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"300 - macOS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"301 - iOS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"302 - iPadOS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"400 - Solaris"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"401 - AIX"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"402 - UX"},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Osint":{"id":"components/schemas/ocsfv1.8.0Osint","kind":"json-schema","title":"ocsfv1.8.0Osint","data":{"title":"ocsfv1.8.0Osint","type":"object","description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.","properties":{"answers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0DnsAnswer"},"nullable":true,"description":"Any pertinent DNS answers information related to an indicator or OSINT analysis."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"MITRE ATT&CK Tactics, Techniques, and/or Procedures (TTPs) pertinent to an indicator or OSINT analysis."},"children":[],"type":"text"}],"type":"paragraph"}]},"autonomous_system":{"$ref":"#/components/schemas/ocsfv1.8.0AutonomousSystem","nullable":true,"description":"Any pertinent autonomous system information related to an indicator or OSINT analysis."},"campaign":{"$ref":"#/components/schemas/ocsfv1.8.0Campaign","nullable":true,"description":"The campaign object describes details about the campaign that was the source of the activity."},"category":{"type":"string","nullable":true,"description":"Categorizes the threat indicator based on its functional or operational role."},"comment":{"type":"string","nullable":true,"description":"Analyst commentary or source commentary about an indicator or OSINT analysis."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence of an indicator being malicious and/or pertinent, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source or analyst."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0Osint_ConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of collected information related to the OSINT or how pertinent an indicator or analysis is to a specific event or finding. A low confidence means that the information collected or analysis conducted lacked detail or is not accurate enough to qualify an indicator as fully malicious."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The timestamp when the indicator was initially created or identified."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when the indicator was initially created or identified."},"creator":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The identifier of the user, system, or organization that contributed the indicator."},"desc":{"type":"string","nullable":true,"description":"A detailed explanation of the indicator, including its context, purpose, and relevance."},"detection_pattern":{"type":"string","nullable":true,"description":"The specific detection pattern or signature associated with the indicator."},"detection_pattern_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The detection pattern type, normalized to the caption of the detection_pattern_type_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"detection_pattern_type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Osint_DetectionPatternTypeId","nullable":true,"description":"Specifies the type of detection pattern used to identify the associated threat indicator."},"email":{"$ref":"#/components/schemas/ocsfv1.8.0Email","nullable":true,"description":"Any email information pertinent to an indicator or OSINT analysis."},"email_auth":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAuth","nullable":true,"description":"Any email authentication information pertinent to an indicator or OSINT analysis."},"expiration_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The expiration date of the indicator, after which it is no longer considered reliable."},"expiration_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The expiration date of the indicator, after which it is no longer considered reliable."},"external_uid":{"type":"string","nullable":true,"description":"A unique identifier assigned by an external system for cross-referencing."},"file":{"$ref":"#/components/schemas/ocsfv1.8.0File","nullable":true,"description":"Any pertinent file information related to an indicator or OSINT analysis."},"intrusion_sets":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A grouping of adversarial behaviors and resources believed to be associated with specific threat actors or campaigns. Intrusion sets often encompass multiple campaigns and are used to organize related activities under a common label."},"kill_chain":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KillChainPhase"},"nullable":true,"description":"Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT analysis."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Tags or keywords associated with the indicator to enhance searchability."},"location":{"$ref":"#/components/schemas/ocsfv1.8.0Location","nullable":true,"description":"Any pertinent geolocation information related to an indicator or OSINT analysis."},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The timestamp of the last modification or update to the indicator."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp of the last modification or update to the indicator."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is a pointer/reference to an attribute within the OCSF event data. For example: file.name."},"children":[],"type":"text"}],"type":"paragraph"}]},"references":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Provides a reference to an external source of information related to the CTI being represented. This may include a URL, a document, or some other type of reference that provides additional context or information about the CTI."},"related_analytics":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Analytic"},"nullable":true,"description":"Any analytics related to an indicator or OSINT analysis."},"reputation":{"$ref":"#/components/schemas/ocsfv1.8.0Reputation","nullable":true,"description":"Related reputational analysis from third-party engines and analysts for a given indicator or OSINT analysis."},"risk_score":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A numerical representation of the threat indicator’s risk level."},"children":[],"type":"text"}],"type":"paragraph"}]},"script":{"$ref":"#/components/schemas/ocsfv1.8.0Script","nullable":true,"description":"Any pertinent script information related to an indicator or OSINT analysis."},"severity":{"type":"string","nullable":true,"description":"Represents the severity level of the threat indicator, typically reflecting its potential impact or damage."},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0Osint_SeverityId","nullable":true,"description":"The normalized severity level of the threat indicator, typically reflecting its potential impact or damage."},"signatures":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0DigitalSignature"},"nullable":true,"description":"Any digital signatures or hashes related to an indicator or OSINT analysis."},"src_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":"The source URL of an indicator or OSINT analysis, e.g., a URL back to a TIP, report, or otherwise."},"subdomains":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Any pertinent subdomain information - such as those generated by a Domain Generation Algorithm - related to an indicator or OSINT analysis."},"subnet":{"$ref":"#/components/schemas/ocsfv1.8.0Subnet","nullable":true,"description":"A CIDR or network block related to an indicator or OSINT analysis."},"threat_actor":{"$ref":"#/components/schemas/ocsfv1.8.0ThreatActor","nullable":true,"description":"A threat actor is an individual or group that conducts malicious cyber activities, often with financial, political, or ideological motives."},"tlp":{"$ref":"#/components/schemas/ocsfv1.8.0Osint_Tlp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.first.org/tlp/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Traffic Light Protocol"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" was created to facilitate greater sharing of potentially sensitive information and more effective collaboration. TLP provides a simple and intuitive schema for indicating with whom potentially sensitive information can be shared."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":"The OSINT indicator type."},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Osint_TypeId","description":"The OSINT indicator type ID."},"uid":{"type":"string","nullable":true,"description":"The unique identifier for the OSINT object."},"uploaded_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The timestamp indicating when the associated indicator or intelligence was added to the system or repository."},"uploaded_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp indicating when the associated indicator or intelligence was added to the system or repository."},"value":{"type":"string","description":"The actual indicator value in scope, e.g., a SHA-256 hash hexdigest or a domain name."},"vendor_name":{"type":"string","nullable":true,"description":"The vendor name of a tool which generates intelligence or provides indicators."},"vulnerabilities":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Vulnerability"},"nullable":true,"description":"Any vulnerabilities related to an indicator or OSINT analysis."},"whois":{"$ref":"#/components/schemas/ocsfv1.8.0Whois","nullable":true,"description":"Any pertinent WHOIS information related to an indicator or OSINT analysis."}},"required":["type_id","value"]}},"components/schemas/ocsfv1.8.0Osint_ConfidenceId":{"id":"components/schemas/ocsfv1.8.0Osint_ConfidenceId","kind":"json-schema","title":"ocsfv1.8.0Osint_ConfidenceId","data":{"title":"ocsfv1.8.0Osint_ConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OsintConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Osint_DetectionPatternTypeId":{"id":"components/schemas/ocsfv1.8.0Osint_DetectionPatternTypeId","kind":"json-schema","title":"ocsfv1.8.0Osint_DetectionPatternTypeId","data":{"title":"ocsfv1.8.0Osint_DetectionPatternTypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OsintDetectionPatternTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is not mapped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - STIX"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - PCRE"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - SIGMA"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Snort"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Suricata"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - YARA"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The detection pattern type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"detection_pattern_type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Osint_SeverityId":{"id":"components/schemas/ocsfv1.8.0Osint_SeverityId","kind":"json-schema","title":"ocsfv1.8.0Osint_SeverityId","data":{"title":"ocsfv1.8.0Osint_SeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OsintSeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Osint_Tlp":{"id":"components/schemas/ocsfv1.8.0Osint_Tlp","kind":"json-schema","title":"ocsfv1.8.0Osint_Tlp","data":{"title":"ocsfv1.8.0Osint_Tlp","type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OsintTlp is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only spread this on a need-to-know basis within their organization and its clients. Note that TLP:AMBER+STRICT restricts sharing to the organization only. Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risk to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may share TLP:AMBER information with members of their own organization and its clients, but only on a need-to-know basis to protect their organization and its clients and prevent further harm. Note: if the source wants to restrict sharing to the organization only, they must specify TLP:AMBER+STRICT."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure, recipients can only spread this on a need-to-know basis within their organization and its clients. Note that TLP:AMBER+STRICT restricts sharing to the organization only. Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risk to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may share TLP:AMBER information with members of their own organization and its clients, but only on a need-to-know basis to protect their organization and its clients and prevent further harm. Note: if the source wants to restrict sharing to the organization only, they must specify TLP:AMBER+STRICT."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the world, there is no limit on disclosure. Sources may use TLP:CLEAR when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be shared without restriction."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can spread this within their community. Sources may use TLP:GREEN when information is useful to increase awareness within their wider community. Recipients may share TLP:GREEN information with peers and partner organizations within their community, but not via publicly accessible channels. TLP:GREEN information may not be shared outside of the community. Note: when “community” is not defined, assume the cybersecurity/defense community."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"RED - RED: TLP:RED is for the eyes and ears of individual recipients only, no further disclosure. Sources may use TLP:RED when information cannot be effectively acted upon without significant risk for the privacy, reputation, or operations of the organizations involved. Recipients may therefore not share TLP:RED information with anyone else. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"WHITE - WHITE: TLP:WHITE and TLP:CLEAR may be used interchangeably, TLP:WHITE is the most up to date (as of TLP 2.0) usage."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Osint_TypeId":{"id":"components/schemas/ocsfv1.8.0Osint_TypeId","kind":"json-schema","title":"ocsfv1.8.0Osint_TypeId","data":{"title":"ocsfv1.8.0Osint_TypeId","type":"integer","description":"OsintTypeId is an enum, and the following values are allowed.\n0 - Unknown: The indicator type is ambiguous or there is not a related indicator for the OSINT object.\n1 - IPAddress: An IPv4 or IPv6 address.\n2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial domain.\n3 - Hostname: A hostname or computer name.\n4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, SSDEEP, VHASH, etc. generated from a file, malware sample, request header, or otherwise used to identify a pertinent artifact.\n5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator (URI).\n6 - UserAgent: A User Agent typically seen in HTTP request headers.\n7 - DigitalCertificate: The serial number, fingerprint, or full content of an X.509 digital certificate.\n8 - Email: The contents of an email or any related information to an email object.\n9 - EmailAddress: An email address.\n10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a weakness, exploit, bug, or misconfiguration.\n11 - File: A file or metadata about a file.\n12 - RegistryKey: A Windows Registry Key.\n13 - RegistryValue: A Windows Registry Value.\n14 - CommandLine: A partial or full Command Line used to invoke scripts or other remote commands.\n99 - Other: The indicator type is not directly listed."}},"components/schemas/ocsfv1.8.0Package":{"id":"components/schemas/ocsfv1.8.0Package","kind":"json-schema","title":"ocsfv1.8.0Package","data":{"title":"ocsfv1.8.0Package","type":"object","description":"The Software Package object describes details about a software package.","properties":{"architecture":{"type":"string","nullable":true,"description":"Architecture is a shorthand name describing the type of computer hardware the packaged software is meant to run on."},"cpe_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Platform Enumeration (CPE) name as described by ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://nvd.nist.gov/products/cpe"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpe:/a:apple:safari:16.2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"epoch":{"type":"integer","nullable":true,"description":"The software package epoch. Epoch is a way to define weighted dependencies based on version numbers."},"hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":"Cryptographic hash to identify the binary instance of a software component. This can include any component such file, package, or library."},"license":{"type":"string","nullable":true,"description":"The software license applied to this package."},"license_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL pointing to the license applied on package or software. This is typically a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"LICENSE.md"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" file within a repository."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","description":"The software package name."},"package_manager":{"type":"string","nullable":true,"description":"The software packager manager utilized to manage a package on a system, e.g. npm, yum, dpkg etc."},"package_manager_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL of the package or library at the package manager, or the specific URL or URI of an internal package manager link such as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AWS CodeArtifact"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Artifactory"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"purl":{"type":"string","nullable":true,"description":"A purl is a URL string used to identify and locate a software package in a mostly universal and uniform way across programming languages, package managers, packaging conventions, tools, APIs and databases."},"release":{"type":"string","nullable":true,"description":"Release is the number of times a version of the software has been packaged."},"src_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The link to the specific library or package such as within "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"GitHub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", this is different from the link to the package manager where the library or package is hosted."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of software package, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Package_TypeId","nullable":true,"description":"The type of software package."},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A unique identifier for the package or library reported by the source tool. E.g., the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"libId"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" within the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"sbom"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field of an OX Security Issue or the SPDX "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"components.*.bom-ref"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor who published the software package."},"version":{"type":"string","description":"The software package version."}},"required":["name","version"]}},"components/schemas/ocsfv1.8.0Package_TypeId":{"id":"components/schemas/ocsfv1.8.0Package_TypeId","kind":"json-schema","title":"ocsfv1.8.0Package_TypeId","data":{"title":"ocsfv1.8.0Package_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"PackageTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Application: An application software package."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - OperatingSystem: An operating system software package."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Packet":{"id":"components/schemas/ocsfv1.8.0Packet","kind":"json-schema","title":"ocsfv1.8.0Packet","data":{"title":"ocsfv1.8.0Packet","type":"object","description":"The Packet object represents a single captured network packet and its associated metadata. It describes where the packet came from, how it is stored or encoded, and how it can be located within a capture file or stream. This object does not interpret protocol content; it only represents the captured packet data and its positioning information.","properties":{"encoding":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-readable name of the encoding used to represent the packet data in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"value"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field. This should match the caption associated with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"encoding_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". If "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"encoding_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is 99 (Other), this field contains the original data source–specific encoding value."},"children":[],"type":"text"}],"type":"paragraph"}]},"encoding_id":{"$ref":"#/components/schemas/ocsfv1.8.0Packet_EncodingId","nullable":true,"description":"The normalized identifier of the encoding method used to represent the packet data as a string."},"end_offset":{"type":"integer","nullable":true,"description":"The ending byte position of this packet within a capture file or stream."},"format":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-readable name of the packet capture file format in which the packet is stored. This should match the caption associated with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"format_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". If "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"format_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is 99 (Other), this field contains the original data source–specific format value."},"children":[],"type":"text"}],"type":"paragraph"}]},"format_id":{"$ref":"#/components/schemas/ocsfv1.8.0Packet_FormatId","nullable":true,"description":"The normalized identifier of the packet capture format."},"sequence_number":{"type":"integer","nullable":true,"description":"The relative order number of this packet within its capture context (such as a PCAP file, network session, or reconstructed stream). This represents chronological capture order, distinct from both protocol-level sequencing (such as TCP sequence numbers)."},"source":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-readable name describing how or where the packet was obtained. This should match the caption associated with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"source_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". If "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"source_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is 99 (Other), this field contains the original data source–specific value."},"children":[],"type":"text"}],"type":"paragraph"}]},"source_id":{"$ref":"#/components/schemas/ocsfv1.8.0Packet_SourceId","nullable":true,"description":"A normalized numeric identifier that specifies how the packet was obtained or generated."},"start_offset":{"type":"integer","nullable":true,"description":"The starting byte position of this packet within a capture file or stream."},"value":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The actual packet data, represented as a string. The format of this string is determined by the specified "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"encoding_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (e.g., Base64, Hexadecimal, or URL Encoded)."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["value"]}},"components/schemas/ocsfv1.8.0Packet_EncodingId":{"id":"components/schemas/ocsfv1.8.0Packet_EncodingId","kind":"json-schema","title":"ocsfv1.8.0Packet_EncodingId","data":{"title":"ocsfv1.8.0Packet_EncodingId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"PacketEncodingId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The encoding format of the packet data is not known."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Base64: The packet data is encoded using Base64."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Hexadecimal: The packet data is encoded as a hexadecimal string representation of the raw bytes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - URLEncoded: The packet data is encoded using percent-encoding (URL encoding)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The encoding method is not mapped. Refer to the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"encoding"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field for the original source-specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Packet_FormatId":{"id":"components/schemas/ocsfv1.8.0Packet_FormatId","kind":"json-schema","title":"ocsfv1.8.0Packet_FormatId","data":{"title":"ocsfv1.8.0Packet_FormatId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"PacketFormatId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The packet format is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - PCAP: Standard libpcap/tcpdump packet capture file format."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - PCAPNG: Next-generation PCAP format that supports multiple interfaces and enhanced metadata."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Snoop: Solaris/Unix capture format."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - ERF: Extensible Record Format used by Endace network monitoring hardware."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - NetMon: Microsoft Network Monitor capture file format."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - 5Views: Accellent 5Views packet capture format."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The packet format is not mapped. Refer to the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"format"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field for the original source-specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Packet_SourceId":{"id":"components/schemas/ocsfv1.8.0Packet_SourceId","kind":"json-schema","title":"ocsfv1.8.0Packet_SourceId","data":{"title":"ocsfv1.8.0Packet_SourceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"PacketSourceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The packet source is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Wire: The packet was captured directly from a network interface."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Stream: The packet was reconstructed or derived from a stream of packets."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Decoder: The packet was generated or extracted by a protocol decoder or analysis engine."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - TAP: The packet was captured from a physical network Test Access Point (TAP) device used for passive monitoring."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - SPAN: The packet was captured from a switch Switched Port Analyzer (SPAN) or mirror port."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Endpoint: The packet was captured by a host-based agent or endpoint detection and response (EDR) sensor."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Virtual: The packet was captured from a virtual network interface, virtual switch, or container network."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The packet source is not mapped. Refer to the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"source"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field for the original source-specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0PhishingProgram":{"id":"components/schemas/ocsfv1.8.0PhishingProgram","kind":"json-schema","title":"ocsfv1.8.0PhishingProgram","data":{"title":"ocsfv1.8.0PhishingProgram","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Phishing Program object describes a recurring phishing simulation program or series used by security awareness platforms. Examples include a KnowBe4 phishing campaign (container of security tests) or an autopilot / campaign-of-the-month schedule. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" This object is distinct from the core threat-actor "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"campaign"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object and must not be conflated with ATT&CK intrusion campaigns."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the phishing program was known to have been created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the phishing program was known to have been created."},"desc":{"type":"string","nullable":true,"description":"The description of the phishing program."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the phishing program was known to have been modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the phishing program was known to have been modified."},"name":{"type":"string","nullable":true,"description":"The name of the phishing program."},"state":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The state of the phishing program, normalized to the caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"state_id":{"$ref":"#/components/schemas/ocsfv1.8.0PhishingProgram_StateId","nullable":true,"description":"The normalized state of the phishing program."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the phishing program."}}}},"components/schemas/ocsfv1.8.0PhishingProgram_StateId":{"id":"components/schemas/ocsfv1.8.0PhishingProgram_StateId","kind":"json-schema","title":"ocsfv1.8.0PhishingProgram_StateId","data":{"title":"ocsfv1.8.0PhishingProgram_StateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"PhishingProgramStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0PhishingSimulation":{"id":"components/schemas/ocsfv1.8.0PhishingSimulation","kind":"json-schema","title":"ocsfv1.8.0PhishingSimulation","data":{"title":"ocsfv1.8.0PhishingSimulation","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Phishing Simulation object describes a single phishing simulation run. A simulation may belong to a parent "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"phishing_program"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the phishing simulation was known to have been created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the phishing simulation was known to have been created."},"desc":{"type":"string","nullable":true,"description":"The description of the phishing simulation."},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of the phishing simulation tracking window."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of the phishing simulation tracking window."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Group"},"nullable":true,"description":"The list of groups who are targeted by the phishing simulation."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the phishing simulation was known to have been modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the phishing simulation was known to have been modified."},"name":{"type":"string","nullable":true,"description":"The name of the phishing simulation."},"num_clicks":{"type":"integer","nullable":true,"description":"The number of clicks on the phishing simulation."},"num_delivered":{"type":"integer","nullable":true,"description":"The number of phishing simulation messages delivered."},"num_failed":{"type":"integer","nullable":true,"description":"The number of users who failed the phishing simulation."},"num_opens":{"type":"integer","nullable":true,"description":"The number of opens of phishing simulation messages."},"num_reports":{"type":"integer","nullable":true,"description":"The number of reports received by users for the phishing simulation."},"num_scheduled":{"type":"integer","nullable":true,"description":"The number of emails scheduled to be sent to users for a phishing simulation."},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of the phishing simulation tracking window."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of the phishing simulation tracking window."},"state":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The state of the phishing simulation, normalized to the caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"state_id":{"$ref":"#/components/schemas/ocsfv1.8.0PhishingSimulation_StateId","nullable":true,"description":"The normalized state of the phishing simulation run."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of the phishing simulation, normalized to the caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0PhishingSimulation_TypeId","nullable":true,"description":"The normalized type of the phishing simulation."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the phishing simulation run."}}}},"components/schemas/ocsfv1.8.0PhishingSimulation_StateId":{"id":"components/schemas/ocsfv1.8.0PhishingSimulation_StateId","kind":"json-schema","title":"ocsfv1.8.0PhishingSimulation_StateId","data":{"title":"ocsfv1.8.0PhishingSimulation_StateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"PhishingSimulationStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Draft: The phishing simulation is a draft."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Scheduled: The phishing simulation is scheduled to be sent."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Running: The phishing simulation is running."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Completed: The phishing simulation is completed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Canceled: The phishing simulation is canceled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Failed: The phishing simulation is failed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0PhishingSimulation_TypeId":{"id":"components/schemas/ocsfv1.8.0PhishingSimulation_TypeId","kind":"json-schema","title":"ocsfv1.8.0PhishingSimulation_TypeId","data":{"title":"ocsfv1.8.0PhishingSimulation_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"PhishingSimulationTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Policy":{"id":"components/schemas/ocsfv1.8.0Policy","kind":"json-schema","title":"ocsfv1.8.0Policy","data":{"title":"ocsfv1.8.0Policy","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Policy object describes the policies that are applicable. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Policy attributes provide traceability to the operational state of the security product at the time that the event was captured, facilitating forensics, troubleshooting, and policy tuning/adjustments."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"data":{"nullable":true,"description":"Additional data about the policy such as the underlying JSON policy itself or other details."},"desc":{"type":"string","nullable":true,"description":"The description of the policy."},"group":{"$ref":"#/components/schemas/ocsfv1.8.0Group","nullable":true,"description":"The policy group."},"is_applied":{"type":"boolean","nullable":true,"description":"A determination if the content of a policy was applied to a target or request, or not."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The policy name. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AdministratorAccess Policy"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The policy type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Identity Policy, Resource Policy, Service Control Policy, etc."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"A unique identifier of the policy instance."},"version":{"type":"string","nullable":true,"description":"The policy version number."}}}},"components/schemas/ocsfv1.8.0PortInfo":{"id":"components/schemas/ocsfv1.8.0PortInfo","kind":"json-schema","title":"ocsfv1.8.0PortInfo","data":{"title":"ocsfv1.8.0PortInfo","type":"object","description":"The Port Information object describes a port and its associated protocol details.","properties":{"port":{"$ref":"#/components/schemas/ocsfv1.8.0Port","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The port number. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"80"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"443"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"22"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"protocol_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The IP protocol name in lowercase, as defined by the Internet Assigned Numbers Authority (IANA). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"tcp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"udp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"protocol_num":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The IP protocol number, as defined by the Internet Assigned Numbers Authority (IANA). For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"6"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for TCP and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"17"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for UDP."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["port"]}},"components/schemas/ocsfv1.8.0Principal":{"id":"components/schemas/ocsfv1.8.0Principal","kind":"json-schema","title":"ocsfv1.8.0Principal","data":{"title":"ocsfv1.8.0Principal","type":"object","description":"The Principal object describes the security principal that holds access: a user, a group, an application, or every user in an organization or tenant.","properties":{"application":{"$ref":"#/components/schemas/ocsfv1.8.0Application","nullable":true,"description":"The application that holds access."},"group":{"$ref":"#/components/schemas/ocsfv1.8.0Group","nullable":true,"description":"The group that holds access."},"name":{"type":"string","nullable":true,"description":"The name of the principal."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The principal type, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Principal_TypeId","description":"The normalized identifier of the principal type."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the principal."},"user":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The user that holds access."}},"required":["type_id"]}},"components/schemas/ocsfv1.8.0Principal_TypeId":{"id":"components/schemas/ocsfv1.8.0Principal_TypeId","kind":"json-schema","title":"ocsfv1.8.0Principal_TypeId","data":{"title":"ocsfv1.8.0Principal_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"PrincipalTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The principal type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - User: A user, including a service account the data source models as a user. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"user.type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Group: A group."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Application: An application. For example, a service principal or managed identity."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - AllUsers: Every user in the organization or tenant. Not public or anonymous access."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The principal type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Process":{"id":"components/schemas/ocsfv1.8.0Process","kind":"json-schema","title":"ocsfv1.8.0Process","data":{"title":"ocsfv1.8.0Process","type":"object","description":"The Process object describes a running instance of a launched program.","properties":{"ancestry":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ProcessEntity"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of Process Entities describing the extended parentage of this process object. Direct parent information should be expressed through the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"parent_process"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute. The first array element is the direct parent of this process object. Subsequent list elements go up the process parentage hierarchy. That is, the array is sorted from newest to oldest process. It is recommended to only populate this field for the top-level process object."},"children":[],"type":"text"}],"type":"paragraph"}]},"cmd_line":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full command line used to launch an application, service, process, or job. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ssh user@10.0.0.10"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". If the command line is unavailable or missing, the empty string "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"''"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is to be used."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpid":{"type":"string","nullable":true,"description":"A unique process identifier that can be assigned deterministically by multiple system data producers."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the process was created/started."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the process was created/started."},"environment_variables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0EnvironmentVariable"},"nullable":true,"description":"Environment variables associated with the process."},"file":{"$ref":"#/components/schemas/ocsfv1.8.0File","nullable":true,"description":"The process file object."},"integrity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The process integrity level, normalized to the caption of the integrity_id value. In the case of 'Other', it is defined by the event source (Windows only)."},"children":[],"type":"text"}],"type":"paragraph"}]},"integrity_id":{"$ref":"#/components/schemas/ocsfv1.8.0Process_IntegrityId","nullable":true,"description":"The normalized identifier of the process integrity level (Windows only)."},"lineage":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0FilePath"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The lineage of the process, represented by a list of paths for each ancestor process. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"['/usr/sbin/sshd', '/usr/bin/bash', '/usr/bin/whoami']"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"loaded_modules":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of loaded module names."},"name":{"$ref":"#/components/schemas/ocsfv1.8.0ProcessName","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The friendly name of the process, for example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notepad++"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"parent_process":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The parent process of this process object. It is recommended to only populate this field for the top-level process object, to prevent deep nesting. Additional ancestry information can be supplied in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ancestry"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute."},"children":[],"type":"text"}],"type":"paragraph"}]},"path":{"type":"string","nullable":true,"description":"The process file path."},"pid":{"type":"integer","nullable":true,"description":"The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process."},"ptid":{"type":"integer","nullable":true,"description":"The identifier of the process thread associated with the event, as returned by the operating system."},"sandbox":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps."},"children":[],"type":"text"}],"type":"paragraph"}]},"session":{"$ref":"#/components/schemas/ocsfv1.8.0Session","nullable":true,"description":"The user session under which this process is running."},"terminated_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the process was terminated."},"terminated_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the process was terminated."},"tid":{"type":"integer","nullable":true,"description":"The identifier of the thread associated with the event, as returned by the operating system."},"uid":{"type":"string","nullable":true,"description":"A unique identifier for this process assigned by the producer (tool).  Facilitates correlation of a process event with other events for that process."},"user":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The user under which this process is running."},"working_directory":{"type":"string","nullable":true,"description":"The working directory of a process."},"xattributes":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"An unordered collection of zero or more name/value pairs that represent a process extended attribute."}}}},"components/schemas/ocsfv1.8.0Process_IntegrityId":{"id":"components/schemas/ocsfv1.8.0Process_IntegrityId","kind":"json-schema","title":"ocsfv1.8.0Process_IntegrityId","data":{"title":"ocsfv1.8.0Process_IntegrityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ProcessIntegrityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The integrity level is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Untrusted"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - System"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Protected"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The integrity level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"integrity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0ProcessEntity":{"id":"components/schemas/ocsfv1.8.0ProcessEntity","kind":"json-schema","title":"ocsfv1.8.0ProcessEntity","data":{"title":"ocsfv1.8.0ProcessEntity","type":"object","description":"The Process Entity object provides critical fields for referencing a process.","properties":{"cmd_line":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The full command line used to launch an application, service, process, or job. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ssh user@10.0.0.10"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". If the command line is unavailable or missing, the empty string "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"''"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is to be used."},"children":[],"type":"text"}],"type":"paragraph"}]},"cpid":{"type":"string","nullable":true,"description":"A unique process identifier that can be assigned deterministically by multiple system data producers."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the process was created/started."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the process was created/started."},"name":{"$ref":"#/components/schemas/ocsfv1.8.0ProcessName","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The friendly name of the process, for example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Notepad++"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"path":{"type":"string","nullable":true,"description":"The process file path."},"pid":{"type":"integer","nullable":true,"description":"The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process."},"uid":{"type":"string","nullable":true,"description":"A unique identifier for this process assigned by the producer (tool).  Facilitates correlation of a process event with other events for that process."}}}},"components/schemas/ocsfv1.8.0Product":{"id":"components/schemas/ocsfv1.8.0Product","kind":"json-schema","title":"ocsfv1.8.0Product","data":{"title":"ocsfv1.8.0Product","type":"object","description":"The Product object describes characteristics of a software product.","properties":{"cpe_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Common Platform Enumeration (CPE) name as described by ("},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://nvd.nist.gov/products/cpe"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"NIST"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":") For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cpe:/a:apple:safari:16.2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"feature":{"$ref":"#/components/schemas/ocsfv1.8.0Feature","nullable":true,"description":"The feature that reported the event."},"lang":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The two letter lower case language codes, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://en.wikipedia.org/wiki/ISO_639-1"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ISO 639-1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"en"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (English), "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"de"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (German), or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"fr"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" (French)."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","nullable":true,"description":"The name of the product."},"path":{"type":"string","nullable":true,"description":"The installation path of the product."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the product."},"url_string":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":"The URL pointing towards the product."},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor of the product."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The version of the product, as defined by the event source. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2013.1.3-beta"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0ProgrammaticCredential":{"id":"components/schemas/ocsfv1.8.0ProgrammaticCredential","kind":"json-schema","title":"ocsfv1.8.0ProgrammaticCredential","data":{"title":"ocsfv1.8.0ProgrammaticCredential","type":"object","description":"The Programmatic Credential object describes service-specific credentials used for direct API access and system integration. These credentials are typically issued by individual services or platforms for accessing their APIs and resources, focusing on credential lifecycle management and usage tracking. Examples include API keys, service account keys, client certificates, and vendor-specific access tokens.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the credential was created or became valid."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the credential was created or became valid."},"expiration_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the credential expires."},"expiration_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the credential expires."},"last_used_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The timestamp when this programmatic credential was last used for authentication or API access. This helps track credential usage patterns, identify dormant credentials that may pose security risks, and support credential lifecycle management. The timestamp should reflect the most recent successful authentication or API call using this credential."},"last_used_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The timestamp when this programmatic credential was last used for authentication or API access. This helps track credential usage patterns, identify dormant credentials that may pose security risks, and support credential lifecycle management. The timestamp should reflect the most recent successful authentication or API call using this credential."},"name":{"type":"string","nullable":true,"description":"The display name of the credential."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The credential type, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0ProgrammaticCredential_TypeId","nullable":true,"description":"The normalized identifier of the programmatic credential type."},"uid":{"type":"string","description":"The unique identifier of the programmatic credential. This could be an API key ID, service account key ID, access token identifier, certificate serial number, or other unique identifier that distinguishes this credential from others. Examples: AWS Access Key ID, GCP Service Account Key ID, Azure Application ID, or OAuth2 token identifier."}},"required":["uid"]}},"components/schemas/ocsfv1.8.0ProgrammaticCredential_TypeId":{"id":"components/schemas/ocsfv1.8.0ProgrammaticCredential_TypeId","kind":"json-schema","title":"ocsfv1.8.0ProgrammaticCredential_TypeId","data":{"title":"ocsfv1.8.0ProgrammaticCredential_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ProgrammaticCredentialTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The credential type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - APIKey: An API key."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - ClientSecret: A client secret or password registered for an application."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Certificate: A certificate or public key registered for the credential holder. For example, a client authentication certificate or a token-signing certificate."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - AccessToken: An access token issued through an OAuth or similar authorization flow."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - ServiceAccountKey: A key issued for a service account."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - PersonalAccessToken: A token a user issues for themselves to access an API."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The credential type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0RelatedEvent":{"id":"components/schemas/ocsfv1.8.0RelatedEvent","kind":"json-schema","title":"ocsfv1.8.0RelatedEvent","data":{"title":"ocsfv1.8.0RelatedEvent","type":"object","description":"The Related Event object describes an event or another finding related to a finding. It may or may not be an OCSF event.","properties":{"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"count":{"type":"integer","nullable":true,"description":"The number of times that activity in the same logical group occurred, as reported by the related Finding."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The time when the related event/finding was created."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" If the related event/finding is in OCSF and is a Finding, then this value should be equal to "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"finding_info.created_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" in the corresponding Finding. If the related event/finding is in OCSF and is not a Finding, then this value should be equal to "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" in the corresponding event."},"children":[],"type":"text"}]},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The time when the related event/finding was created."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" If the related event/finding is in OCSF and is a Finding, then this value should be equal to "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"finding_info.created_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" in the corresponding Finding. If the related event/finding is in OCSF and is not a Finding, then this value should be equal to "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" in the corresponding event."},"children":[],"type":"text"}]},"desc":{"type":"string","nullable":true,"description":"A description of the related event/finding."},"first_seen_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The time when the finding was first observed. e.g. The time when a vulnerability was first observed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"It can differ from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"created_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" timestamp, which reflects the time this finding was created."},"children":[],"type":"text"}],"type":"paragraph"}]},"first_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The time when the finding was first observed. e.g. The time when a vulnerability was first observed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"It can differ from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"created_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" timestamp, which reflects the time this finding was created."},"children":[],"type":"text"}],"type":"paragraph"}]},"kill_chain":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KillChainPhase"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Cyber Kill Chain®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" provides a detailed description of each phase and its associated activities within the broader context of a cyber attack."},"children":[],"type":"text"}],"type":"paragraph"}]},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The time when the finding was most recently observed. e.g. The time when a vulnerability was most recently observed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"It can differ from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"modified_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" timestamp, which reflects the time this finding was last modified."},"children":[],"type":"text"}],"type":"paragraph"}]},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The time when the finding was most recently observed. e.g. The time when a vulnerability was most recently observed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"It can differ from the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"modified_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" timestamp, which reflects the time this finding was last modified."},"children":[],"type":"text"}],"type":"paragraph"}]},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the related event/finding was last modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the related event/finding was last modified."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"product":{"$ref":"#/components/schemas/ocsfv1.8.0Product","nullable":true,"description":"Details about the product that reported the related event/finding."},"product_uid":{"type":"string","nullable":true,"description":"The unique identifier of the product that reported the related event."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0RelatedEvent_SeverityId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The related event status. Should correspond to the label of the status_id (or 'Other' status value for status_id = 99) of the related event."},"children":[],"type":"text"}],"type":"paragraph"}]},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated with the related event/finding."},"children":[],"type":"text"}],"type":"paragraph"}]},"title":{"type":"string","nullable":true,"description":"A title or a brief phrase summarizing the related event/finding."},"traits":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Trait"},"nullable":true,"description":"The list of key traits or characteristics extracted from the related event/finding that influenced or contributed to the overall finding's outcome."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The type of the related event/finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"Populate if the related event/finding is "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"NOT"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" in OCSF. If it is in OCSF, then utilize "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"type_name, type_uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" instead."},"children":[],"type":"text"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of the related OCSF event, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Process Activity: Launch."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Populate if the related event/finding is in OCSF."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the related OCSF event type. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"100701."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Populate if the related event/finding is in OCSF."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The unique identifier of the related event/finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" If the related event/finding is in OCSF, then this value must be equal to "},"children":[],"type":"text"},{"$$mdtype":"Node","attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"metadata.uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":" in the corresponding event."},"children":[],"type":"text"}]}},"required":["uid"]}},"components/schemas/ocsfv1.8.0RelatedEvent_SeverityId":{"id":"components/schemas/ocsfv1.8.0RelatedEvent_SeverityId","kind":"json-schema","title":"ocsfv1.8.0RelatedEvent_SeverityId","data":{"title":"ocsfv1.8.0RelatedEvent_SeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RelatedEventSeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Remediation":{"id":"components/schemas/ocsfv1.8.0Remediation","kind":"json-schema","title":"ocsfv1.8.0Remediation","data":{"title":"ocsfv1.8.0Remediation","type":"object","description":"The Remediation object describes the recommended remediation steps to address identified issue(s).","properties":{"cis_controls":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0CisControl"},"nullable":true,"description":"An array of Center for Internet Security (CIS) Controls that can be optionally mapped to provide additional remediation details."},"desc":{"type":"string","description":"The description of the remediation strategy."},"kb_article_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KbArticle"},"nullable":true,"description":"A list of KB articles or patches related to an endpoint. A KB Article contains metadata that describes the patch or an update."},"kb_articles":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The KB article/s related to the entity. A KB Article contains metadata that describes the patch or an update."},"references":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of supporting URL/s, references that help describe the remediation strategy."}},"required":["desc"]}},"components/schemas/ocsfv1.8.0Reporter":{"id":"components/schemas/ocsfv1.8.0Reporter","kind":"json-schema","title":"ocsfv1.8.0Reporter","data":{"title":"ocsfv1.8.0Reporter","type":"object","description":"The entity from which an event or finding was reported.","properties":{"hostname":{"$ref":"#/components/schemas/ocsfv1.8.0Hostname","nullable":true,"description":"The hostname of the entity from which the event or finding was reported."},"ip":{"$ref":"#/components/schemas/ocsfv1.8.0IPAddress","nullable":true,"description":"The IP address of the entity from which the event or finding was reported."},"name":{"type":"string","nullable":true,"description":"The name of the entity from which the event or finding was reported."},"org":{"$ref":"#/components/schemas/ocsfv1.8.0Organization","nullable":true,"description":"The organization properties of the entity that reported the event or finding."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the entity from which the event or finding was reported."}}}},"components/schemas/ocsfv1.8.0Reputation":{"id":"components/schemas/ocsfv1.8.0Reputation","kind":"json-schema","title":"ocsfv1.8.0Reputation","data":{"title":"ocsfv1.8.0Reputation","type":"object","description":"The Reputation object describes the reputation/risk score of an entity (e.g. device, user, domain).","properties":{"base_score":{"type":"number","format":"double","description":"The reputation score as reported by the event source."},"provider":{"type":"string","nullable":true,"description":"The provider of the reputation information."},"score":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The reputation score, normalized to the caption of the score_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"score_id":{"$ref":"#/components/schemas/ocsfv1.8.0Reputation_ScoreId","description":"The normalized reputation score identifier."}},"required":["base_score","score_id"]}},"components/schemas/ocsfv1.8.0Reputation_ScoreId":{"id":"components/schemas/ocsfv1.8.0Reputation_ScoreId","kind":"json-schema","title":"ocsfv1.8.0Reputation_ScoreId","data":{"title":"ocsfv1.8.0Reputation_ScoreId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ReputationScoreId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The reputation score is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - VerySafe: Long history of good behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Safe: Consistently good behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - ProbablySafe: Reasonable history of good behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - LeansSafe: Starting to establish a history of normal behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - MaynotbeSafe: No established history of normal behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - ExerciseCaution: Starting to establish a history of suspicious or risky behavior."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Risky: A site with a history of suspicious or risky behavior. (spam, scam, potentially unwanted software, potentially malicious)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - PossiblyMalicious: Strong possibility of maliciousness."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - ProbablyMalicious: Indicators of maliciousness."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Malicious: Proven evidence of maliciousness."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The reputation score is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"rep_score"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Request":{"id":"components/schemas/ocsfv1.8.0Request","kind":"json-schema","title":"ocsfv1.8.0Request","data":{"title":"ocsfv1.8.0Request","type":"object","description":"The Request Elements object describes characteristics of an API request.","properties":{"containers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Container"},"nullable":true,"description":"When working with containerized applications, the set of containers which write to the standard the output of a particular logging driver. For example, this may be the set of containers involved in handling api requests and responses for a containerized application."},"data":{"nullable":true,"description":"The additional data that is associated with the api request."},"flags":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The communication flags that are associated with the api request."},"uid":{"type":"string","description":"The unique request identifier."}},"required":["uid"]}},"components/schemas/ocsfv1.8.0ResourceDetails":{"id":"components/schemas/ocsfv1.8.0ResourceDetails","kind":"json-schema","title":"ocsfv1.8.0ResourceDetails","data":{"title":"ocsfv1.8.0ResourceDetails","type":"object","description":"The Resource Details object describes details about resources that were affected by the activity/event.","properties":{"agent_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Agent"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A list of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"agent"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects associated with a device, endpoint, or resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"cloud_partition":{"type":"string","nullable":true,"description":"The logical grouping or isolated segment within a cloud provider's infrastructure where the resource is located. Examples include AWS partitions (aws, aws-cn, aws-us-gov), Azure cloud environments (AzureCloud, AzureUSGovernment, AzureChinaCloud), or similar logical divisions in other cloud providers."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the resource was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the resource was created."},"criticality":{"type":"string","nullable":true,"description":"The criticality of the resource as defined by the event source."},"data":{"nullable":true,"description":"Additional data describing the resource."},"group":{"$ref":"#/components/schemas/ocsfv1.8.0Group","nullable":true,"description":"The name of the related resource group."},"hostname":{"$ref":"#/components/schemas/ocsfv1.8.0Hostname","nullable":true,"description":"The fully qualified name of the resource."},"ip":{"$ref":"#/components/schemas/ocsfv1.8.0IPAddress","nullable":true,"description":"The IP address of the resource, in either IPv4 or IPv6 format."},"is_backed_up":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates whether the device or resource has a backup enabled, such as an automated snapshot or a cloud backup. For example, this is indicated by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cloudBackupEnabled"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value within JAMF Pro mobile devices or the registration of an AWS ARN with the AWS Backup service."},"children":[],"type":"text"}],"type":"paragraph"}]},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels associated to the resource."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the resource was last modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the resource was last modified."},"name":{"type":"string","nullable":true,"description":"The name of the resource."},"namespace":{"type":"string","nullable":true,"description":"The namespace is useful when similar entities exist that you need to keep separate."},"owner":{"$ref":"#/components/schemas/ocsfv1.8.0User","nullable":true,"description":"The details of the entity that owns the resource. This object includes properties such as the owner's name, unique identifier, type, domain, and other relevant attributes that help identify the resource owner within the environment."},"provider":{"type":"string","nullable":true,"description":"The cloud service provider that hosts or manages the resource. This field is typically used when the resource is managed by a different provider than the one generating the event or finding. Examples include AWS, Azure, GCP (Google Cloud Platform), Oracle Cloud, IBM Cloud, Alibaba Cloud, or other public, private, or hybrid cloud providers."},"region":{"type":"string","nullable":true,"description":"The cloud region where the resource is hosted, as defined by the cloud provider. This represents the physical or logical geographic area containing the infrastructure supporting the resource. Examples include AWS regions (us-east-1, eu-west-1), Azure regions (East US, West Europe), GCP regions (us-central1, europe-west1), or Oracle Cloud regions (us-ashburn-1, uk-london-1)."},"resource_relationship":{"$ref":"#/components/schemas/ocsfv1.8.0Graph","nullable":true,"description":"A graph representation showing how this resource relates to and interacts with other entities in the environment. This can include parent/child relationships, dependencies, or other connections."},"role":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The role of the resource in the context of the event or finding, normalized to the caption of the role_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"role_id":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails_RoleId","nullable":true,"description":"The normalized identifier of the resource's role in the context of the event or finding."},"src_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":"The URL of the resource in the event sources system."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"type":{"type":"string","nullable":true,"description":"The resource type as defined by the event source."},"uid":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceUID","nullable":true,"description":"The unique identifier of the resource."},"uid_alt":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceUID","nullable":true,"description":"The alternative unique identifier of the resource."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The version of the resource. For example "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.2.3"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"zone":{"type":"string","nullable":true,"description":"The availability zone within a cloud region where the resource is located. Examples include AWS availability zones (us-east-1a, us-east-1b), Azure availability zones (1, 2, 3 within a region), GCP zones (us-central1-a, us-central1-b), or Oracle Cloud availability domains (AD-1, AD-2, AD-3)."}}}},"components/schemas/ocsfv1.8.0ResourceDetails_RoleId":{"id":"components/schemas/ocsfv1.8.0ResourceDetails_RoleId","kind":"json-schema","title":"ocsfv1.8.0ResourceDetails_RoleId","data":{"title":"ocsfv1.8.0ResourceDetails_RoleId","type":"integer","description":"ResourceDetailsRoleId is an enum, and the following values are allowed.\n0 - Unknown: The role is unknown.\n1 - Target: The resource is the primary target or subject of the event/finding.\n2 - Actor: The resource is acting as the initiator or performer in the context of the event/finding.\n3 - Affected: The resource was impacted or affected by the event/finding.\n4 - Related: The resource is related to or associated with the event/finding.\n99 - Other: The role is not mapped. See the role attribute, which contains a data source specific value."}},"components/schemas/ocsfv1.8.0Response":{"id":"components/schemas/ocsfv1.8.0Response","kind":"json-schema","title":"ocsfv1.8.0Response","data":{"title":"ocsfv1.8.0Response","type":"object","description":"The Response Elements object describes characteristics of an API response.","properties":{"code":{"type":"integer","nullable":true,"description":"The numeric response sent to a request."},"containers":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Container"},"nullable":true,"description":"When working with containerized applications, the set of containers which write to the standard the output of a particular logging driver. For example, this may be the set of containers involved in handling api requests and responses for a containerized application."},"data":{"nullable":true,"description":"The additional data that is associated with the api response."},"error":{"type":"string","nullable":true,"description":"Error Code"},"error_message":{"type":"string","nullable":true,"description":"Error Message"},"flags":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The communication flags that are associated with the api response."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."}}}},"components/schemas/ocsfv1.8.0Rule":{"id":"components/schemas/ocsfv1.8.0Rule","kind":"json-schema","title":"ocsfv1.8.0Rule","data":{"title":"ocsfv1.8.0Rule","type":"object","description":"The Rule object describes characteristics of a rule associated with a policy or an event.","properties":{"category":{"type":"string","nullable":true,"description":"The rule category."},"desc":{"type":"string","nullable":true,"description":"The description of the rule that generated the event."},"name":{"type":"string","nullable":true,"description":"The name of the rule that generated the event."},"type":{"type":"string","nullable":true,"description":"The rule type."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the rule that generated the event."},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The rule version. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0San":{"id":"components/schemas/ocsfv1.8.0San","kind":"json-schema","title":"ocsfv1.8.0San","data":{"title":"ocsfv1.8.0San","type":"object","description":"The Subject Alternative name (SAN) object describes a SAN secured by a digital certificate","properties":{"name":{"type":"string","description":"Name of SAN (e.g. The actual IP Address or domain.)"},"type":{"type":"string","description":"Type descriptor of SAN (e.g. IP Address/domain/etc.)"}},"required":["name","type"]}},"components/schemas/ocsfv1.8.0Sbom":{"id":"components/schemas/ocsfv1.8.0Sbom","kind":"json-schema","title":"ocsfv1.8.0Sbom","data":{"title":"ocsfv1.8.0Sbom","type":"object","description":"The Software Bill of Materials object describes characteristics of a generated SBOM.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the SBOM was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the SBOM was created."},"package":{"$ref":"#/components/schemas/ocsfv1.8.0Package","description":"The software package or library that is being discovered or inventoried by an SBOM."},"product":{"$ref":"#/components/schemas/ocsfv1.8.0Product","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Details about the upstream product that generated the SBOM e.g. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"cdxgen"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Syft"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"software_components":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0SoftwareComponent"},"description":"The list of software components used in the software package."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of SBOM, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Sbom_TypeId","nullable":true,"description":"The type of SBOM."},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A unique identifier for the SBOM or the SBOM generation by a source tool, such as the SPDX "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"metadata.component.bom-ref"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The specification (spec) version of the particular SBOM, e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1.6"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["package","software_components"]}},"components/schemas/ocsfv1.8.0Sbom_TypeId":{"id":"components/schemas/ocsfv1.8.0Sbom_TypeId","kind":"json-schema","title":"ocsfv1.8.0Sbom_TypeId","data":{"title":"ocsfv1.8.0Sbom_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SbomTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - SPDX: System Package Data Exchange (SPDX®) is an open standard capable of representing systems with software components in as SBOMs (Software Bill of Materials) and other AI, data and security references supporting a range of risk management use cases. The SPDX specification is a freely available international open standard (ISO/IEC 5692:2021)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - CycloneDX: CycloneDX is an International Standard for Bill of Materials (ECMA-424)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - SWID: The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) publishes, ISO/IEC 19770-2, a standard for software identification (SWID) tags that defines a structured metadata format for describing a software product. A SWID tag document is composed of a structured set of data elements that identify the software product"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Scan":{"id":"components/schemas/ocsfv1.8.0Scan","kind":"json-schema","title":"ocsfv1.8.0Scan","data":{"title":"ocsfv1.8.0Scan","type":"object","description":"The Scan object describes characteristics of a proactive scan.","properties":{"name":{"type":"string","nullable":true,"description":"The administrator-supplied or application-generated name of the scan. For example: \"Home office weekly user database scan\", \"Scan folders for viruses\", \"Full system virus scan\""},"type":{"type":"string","nullable":true,"description":"The type of scan."},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Scan_TypeId","description":"The type id of the scan."},"uid":{"type":"string","nullable":true,"description":"The application-defined unique identifier assigned to an instance of a scan."}},"required":["type_id"]}},"components/schemas/ocsfv1.8.0Scan_TypeId":{"id":"components/schemas/ocsfv1.8.0Scan_TypeId","kind":"json-schema","title":"ocsfv1.8.0Scan_TypeId","data":{"title":"ocsfv1.8.0Scan_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ScanTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Manual: The scan was manually initiated by the user or administrator."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Scheduled: The scan was started based on scheduler."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - UpdatedContent: The scan was triggered by a content update."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - QuarantinedItems: The scan was triggered by newly quarantined items."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - AttachedMedia: The scan was triggered by the attachment of removable media."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - UserLogon: The scan was started due to a user logon."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - ELAM: The scan was triggered by an Early Launch Anti-Malware (ELAM) detection."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The scan type id is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Scim":{"id":"components/schemas/ocsfv1.8.0Scim","kind":"json-schema","title":"ocsfv1.8.0Scim","data":{"title":"ocsfv1.8.0Scim","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The System for Cross-domain Identity Management (SCIM) Configuration object provides a structured set of attributes related to SCIM protocols used for identity provisioning and management across cloud-based platforms. It standardizes user and group provisioning details, enabling identity synchronization and lifecycle management with compatible Identity Providers (IdPs) and applications. SCIM is defined in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc7643"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-7634"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"auth_protocol":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The authorization protocol as defined by the caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"auth_protocol_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"auth_protocol_id":{"$ref":"#/components/schemas/ocsfv1.8.0Scim_AuthProtocolId","nullable":true,"description":"The normalized identifier of the authorization protocol used by the SCIM resource."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"When the SCIM resource was added to the service provider."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"When the SCIM resource was added to the service provider."},"error_message":{"type":"string","nullable":true,"description":"Message or code associated with the last encountered error."},"is_group_provisioning_enabled":{"type":"boolean","nullable":true,"description":"Indicates whether the SCIM resource is configured to provision groups, automatically or otherwise."},"is_user_provisioning_enabled":{"type":"boolean","nullable":true,"description":"Indicates whether the SCIM resource is configured to provision users, automatically or otherwise."},"last_run_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"Timestamp of the most recent successful synchronization."},"last_run_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the most recent successful synchronization."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The most recent time when the SCIM resource was updated at the service provider."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent time when the SCIM resource was updated at the service provider."},"name":{"type":"string","nullable":true,"description":"The name of the SCIM resource."},"protocol_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The supported protocol for the SCIM resource. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SAML"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OIDC"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OAuth2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"rate_limit":{"type":"integer","nullable":true,"description":"Maximum number of requests allowed by the SCIM resource within a specified time frame to avoid throttling."},"scim_group_schema":{"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SCIM provides a schema for representing groups, identified using the following schema URI: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"urn:ietf:params:scim:schemas:core:2.0:Group"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" as defined in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc7643"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-7634"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". This attribute will capture key-value pairs for the scheme implemented in a SCIM resource."},"children":[],"type":"text"}],"type":"paragraph"}]},"scim_user_schema":{"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SCIM provides a resource type for user resources. The core schema for user is identified using the following schema URI: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"urn:ietf:params:scim:schemas:core:2.0:User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" as defined in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc7643"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-7634"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". his attribute will capture key-value pairs for the scheme implemented in a SCIM resource. This object is inclusive of both the basic and Enterprise User Schema Extension."},"children":[],"type":"text"}],"type":"paragraph"}]},"state":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The provisioning state of the SCIM resource, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"state_id":{"$ref":"#/components/schemas/ocsfv1.8.0Scim_StateId","nullable":true,"description":"The normalized state ID of the SCIM resource to reflect its activation status."},"uid":{"type":"string","nullable":true,"description":"A unique identifier for a SCIM resource as defined by the service provider."},"uid_alt":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A String that is an identifier for the resource as defined by the provisioning client. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"externalId"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" may simplify identification of a resource between the provisioning client and the service provider by allowing the client to use a filter to locate the resource with an identifier from the provisioning domain, obviating the need to store a local mapping between the provisioning domain's identifier of the resource and the identifier used by the service provider."},"children":[],"type":"text"}],"type":"paragraph"}]},"url_string":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":"The primary URL for SCIM API requests."},"vendor_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Name of the vendor or service provider implementing SCIM. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Okta"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Auth0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Microsoft"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"version":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SCIM protocol version supported e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SCIM 2.0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0Scim_AuthProtocolId":{"id":"components/schemas/ocsfv1.8.0Scim_AuthProtocolId","kind":"json-schema","title":"ocsfv1.8.0Scim_AuthProtocolId","data":{"title":"ocsfv1.8.0Scim_AuthProtocolId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ScimAuthProtocolId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The authentication protocol is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - NTLM"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Kerberos"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Digest"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - OpenID"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - SAML"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - 0"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - PAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - CHAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - EAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - RADIUS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - BasicAuthentication"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - LDAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The authentication protocol is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"auth_protocol"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Scim_StateId":{"id":"components/schemas/ocsfv1.8.0Scim_StateId","kind":"json-schema","title":"ocsfv1.8.0Scim_StateId","data":{"title":"ocsfv1.8.0Scim_StateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ScimStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The provisioning state of the SCIM resource is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Pending: The SCIM resource is Pending activation or creation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Active: The SCIM resource is in an Active state, or otherwise enabled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Failed: The SCIM resource is in a Failed state."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Deleted: The SCIM resource is in a Deleted state, or otherwise disabled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The provisioning state of the SCIM resource is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Script":{"id":"components/schemas/ocsfv1.8.0Script","kind":"json-schema","title":"ocsfv1.8.0Script","data":{"title":"ocsfv1.8.0Script","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Script object describes a script or command that can be executed by a shell, script engine, or interpreter. Examples include Bash, JavsScript, PowerShell, Python, VBScript, etc. Note that the term "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"em","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"script"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" here denotes not only a script contained within a file but also a script or command typed interactively by a user, supplied on the command line, or provided by some other file-less mechanism."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"file":{"$ref":"#/components/schemas/ocsfv1.8.0File","nullable":true,"description":"Present if this script is associated with a file. Not present in the case of a file-less script."},"hashes":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of the script's cryptographic hashes. Note that these hashes are calculated on the script in its original encoding, and not on the normalized UTF-8 encoding found in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"script_content"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","nullable":true,"description":"Unique identifier for the script or macro, independent of the containing file, used for tracking, auditing, and security analysis."},"parent_uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"This attribute relates a sub-script to a parent script having the matching "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"uid"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute. In the case of PowerShell, sub-script execution can be identified by matching the activity correlation ID of the raw ETW events provided by the OS."},"children":[],"type":"text"}],"type":"paragraph"}]},"script_content":{"$ref":"#/components/schemas/ocsfv1.8.0LongString","description":"The script content, normalized to UTF-8 encoding irrespective of its original encoding. When emitting this attribute, it may be appropriate to truncate large scripts. When consuming this attribute, large scripts should be anticipated."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The script type, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Script_TypeId","description":"The normalized script type ID."},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Some script engines assign a unique ID to each individual execution of a given script. This attribute captures that unique ID. In the case of PowerShell, the unique ID corresponds to the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ScriptBlockId"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in the raw ETW events provided by the OS."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["script_content","type_id"]}},"components/schemas/ocsfv1.8.0Script_TypeId":{"id":"components/schemas/ocsfv1.8.0Script_TypeId","kind":"json-schema","title":"ocsfv1.8.0Script_TypeId","data":{"title":"ocsfv1.8.0Script_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ScriptTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The script type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - WindowsCommandPrompt"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - PowerShell"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Python"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - JavaScript"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - VBScript"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - UnixShell"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - VBA"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The script type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute which contains an event source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Service":{"id":"components/schemas/ocsfv1.8.0Service","kind":"json-schema","title":"ocsfv1.8.0Service","data":{"title":"ocsfv1.8.0Service","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Service object describes characteristics of a service, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. AWS EC2. "},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The list of labels associated with the service."},"name":{"type":"string","nullable":true,"description":"The name of the service."},"tags":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KeyValueObject"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The list of tags; "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"{key:value}"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" pairs associated to the service."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the service."},"version":{"type":"string","nullable":true,"description":"The version of the service."}}}},"components/schemas/ocsfv1.8.0Session":{"id":"components/schemas/ocsfv1.8.0Session","kind":"json-schema","title":"ocsfv1.8.0Session","data":{"title":"ocsfv1.8.0Session","type":"object","description":"The Session object describes details about an authenticated session. e.g. Session Creation Time, Session Issuer.","properties":{"count":{"type":"integer","nullable":true,"description":"The number of identical sessions spawned from the same source IP, destination IP, application, and content/threat type seen over a period of time."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the session was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the session was created."},"credential_uid":{"type":"string","nullable":true,"description":"The unique identifier of the user's credential. For example, AWS Access Key ID."},"expiration_reason":{"type":"string","nullable":true,"description":"The reason which triggered the session expiration."},"expiration_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The session expiration time."},"expiration_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The session expiration time."},"is_mfa":{"type":"boolean","nullable":true,"description":"Indicates whether Multi Factor Authentication was used during authentication."},"is_remote":{"type":"boolean","nullable":true,"description":"The indication of whether the session is remote."},"is_vpn":{"type":"boolean","nullable":true,"description":"The indication of whether the session is a VPN session."},"issuer":{"type":"string","nullable":true,"description":"The identifier of the session issuer."},"terminal":{"type":"string","nullable":true,"description":"The Pseudo Terminal associated with the session. Ex: the tty or pts value."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the session."},"uid_alt":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The alternate unique identifier of the session. e.g. AWS ARN - "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"arn:aws:sts::123344444444:assumed-role/Admin/example-session"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uuid":{"type":"string","nullable":true,"description":"The universally unique identifier of the session."}}}},"components/schemas/ocsfv1.8.0SoftwareComponent":{"id":"components/schemas/ocsfv1.8.0SoftwareComponent","kind":"json-schema","title":"ocsfv1.8.0SoftwareComponent","data":{"title":"ocsfv1.8.0SoftwareComponent","type":"object","description":"The Software Component object describes characteristics of a software component within a software package.","properties":{"author":{"type":"string","nullable":true,"description":"The author(s) who published the software component."},"hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":"Cryptographic hash to identify the binary instance of a software component."},"license":{"type":"string","nullable":true,"description":"The software license applied to this component."},"name":{"type":"string","description":"The software component name."},"purl":{"type":"string","nullable":true,"description":"The Package URL (PURL) to identify the software component. This is a URL that uniquely identifies the component, including the component's name, version, and type. The URL is used to locate and retrieve the component's metadata and content."},"related_component":{"type":"string","nullable":true,"description":"The package URL (PURL) of the component that this software component has a relationship with."},"relationship":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The relationship between two software components, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"relationship_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"relationship_id":{"$ref":"#/components/schemas/ocsfv1.8.0SoftwareComponent_RelationshipId","nullable":true,"description":"The normalized identifier of the relationship between two software components."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of software component, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0SoftwareComponent_TypeId","nullable":true,"description":"The type of software component."},"version":{"type":"string","description":"The software component version."}},"required":["name","version"]}},"components/schemas/ocsfv1.8.0SoftwareComponent_RelationshipId":{"id":"components/schemas/ocsfv1.8.0SoftwareComponent_RelationshipId","kind":"json-schema","title":"ocsfv1.8.0SoftwareComponent_RelationshipId","data":{"title":"ocsfv1.8.0SoftwareComponent_RelationshipId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SoftwareComponentRelationshipId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The relationship is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - DependsOn: The component is a dependency of another component. Can be used to define both direct and transitive dependencies."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The relationship is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"relationship"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0SoftwareComponent_TypeId":{"id":"components/schemas/ocsfv1.8.0SoftwareComponent_TypeId","kind":"json-schema","title":"ocsfv1.8.0SoftwareComponent_TypeId","data":{"title":"ocsfv1.8.0SoftwareComponent_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SoftwareComponentTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Framework: A software framework."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Library: A software library."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - OperatingSystem: An operating system. Useful for SBOMs of container images."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Sso":{"id":"components/schemas/ocsfv1.8.0Sso","kind":"json-schema","title":"ocsfv1.8.0Sso","data":{"title":"ocsfv1.8.0Sso","type":"object","description":"The Single Sign-On (SSO) object provides a structure for normalizing SSO attributes, configuration, and/or settings from Identity Providers.","properties":{"auth_protocol":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The authorization protocol as defined by the caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"auth_protocol_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"auth_protocol_id":{"$ref":"#/components/schemas/ocsfv1.8.0Sso_AuthProtocolId","nullable":true,"description":"The normalized identifier of the authentication protocol used by the SSO resource."},"certificate":{"$ref":"#/components/schemas/ocsfv1.8.0Certificate","nullable":true,"description":"Digital Signature associated with the SSO resource, e.g., SAML X.509 certificate details."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"When the SSO resource was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"When the SSO resource was created."},"duration_mins":{"type":"integer","nullable":true,"description":"The duration (in minutes) for an SSO session, after which re-authentication is required."},"idle_timeout":{"type":"integer","nullable":true,"description":"Duration (in minutes) of allowed inactivity before Single Sign-On (SSO) session expiration."},"login_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":"URL for initiating an SSO login request."},"logout_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":"URL for initiating an SSO logout request, allowing sessions to be terminated across applications."},"metadata_endpoint":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":"URL where metadata about the SSO configuration is available (e.g., for SAML configurations)."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The most recent time when the SSO resource was updated."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent time when the SSO resource was updated."},"name":{"type":"string","nullable":true,"description":"The name of the SSO resource."},"protocol_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The supported protocol for the SSO resource. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SAML"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"OIDC"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"scopes":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Scopes define the specific permissions or actions that the client is allowed to perform on behalf of the user. Each scope represents a different set of permissions, and the user can selectively grant or deny access to specific scopes during the authorization process."},"uid":{"type":"string","nullable":true,"description":"A unique identifier for a SSO resource."},"vendor_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Name of the vendor or service provider implementing SSO. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Okta"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Auth0"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Microsoft"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0Sso_AuthProtocolId":{"id":"components/schemas/ocsfv1.8.0Sso_AuthProtocolId","kind":"json-schema","title":"ocsfv1.8.0Sso_AuthProtocolId","data":{"title":"ocsfv1.8.0Sso_AuthProtocolId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SsoAuthProtocolId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The authentication protocol is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - NTLM"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Kerberos"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Digest"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - OpenID"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - SAML"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - 0"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - PAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - CHAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - EAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - RADIUS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - BasicAuthentication"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - LDAP"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The authentication protocol is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"auth_protocol"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0SubTechnique":{"id":"components/schemas/ocsfv1.8.0SubTechnique","kind":"json-schema","title":"ocsfv1.8.0SubTechnique","data":{"title":"ocsfv1.8.0SubTechnique","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE Sub-technique object describes the ATT&CK® or ATLAS™ Sub-technique ID and/or name associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the attack sub-technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Scanning IP Blocks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User Execution: Unsafe ML Artifacts"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The versioned permalink of the attack sub-technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://attack.mitre.org/versions/v14/techniques/T1595/001/"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the attack sub-technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"T1595.001"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AML.T0011.000"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0Table":{"id":"components/schemas/ocsfv1.8.0Table","kind":"json-schema","title":"ocsfv1.8.0Table","data":{"title":"ocsfv1.8.0Table","type":"object","description":"The table object represents a table within a structured relational database or datastore, which contains columns and rows of data that are able to be create, updated, deleted and queried.","properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the table was known to have been created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the table was known to have been created."},"desc":{"type":"string","nullable":true,"description":"The description of the table."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Group"},"nullable":true,"description":"The group names to which the table belongs."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The most recent time when any changes, updates, or modifications were made within the table."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The most recent time when any changes, updates, or modifications were made within the table."},"name":{"type":"string","nullable":true,"description":"The table name, ordinarily as assigned by a database administrator."},"size":{"type":"integer","nullable":true,"description":"The size of the data table in bytes."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the table."}}}},"components/schemas/ocsfv1.8.0Tactic":{"id":"components/schemas/ocsfv1.8.0Tactic","kind":"json-schema","title":"ocsfv1.8.0Tactic","data":{"title":"ocsfv1.8.0Tactic","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE Tactic object describes the ATT&CK® or ATLAS™ Tactic ID and/or name that is associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Tactic name that is associated with the attack technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Reconnaissance"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ML Model Access"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The versioned permalink of the Tactic. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://attack.mitre.org/versions/v14/tactics/TA0043/"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Tactic ID that is associated with the attack technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TA0043"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AML.TA0000"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0Technique":{"id":"components/schemas/ocsfv1.8.0Technique","kind":"json-schema","title":"ocsfv1.8.0Technique","data":{"title":"ocsfv1.8.0Technique","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The MITRE Technique object describes the ATT&CK® or ATLAS™ Technique ID and/or name associated to an attack."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The name of the attack technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Active Scanning"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AI Model Inference API Access"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"src_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The versioned permalink of the attack technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://attack.mitre.org/versions/v14/techniques/T1595/"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique identifier of the attack technique. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"T1595"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"AML.T0040"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0ThreatActor":{"id":"components/schemas/ocsfv1.8.0ThreatActor","kind":"json-schema","title":"ocsfv1.8.0ThreatActor","data":{"title":"ocsfv1.8.0ThreatActor","type":"object","description":"Threat actor is responsible for the observed malicious activity.","properties":{"name":{"type":"string","description":"The name of the threat actor."},"type":{"type":"string","nullable":true,"description":"The classification of the threat actor based on their motivations, capabilities, or affiliations. Common types include nation-state actors, cybercriminal groups, hacktivists, or insider threats."},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0ThreatActor_TypeId","nullable":true,"description":"The normalized datastore resource type identifier."}},"required":["name"]}},"components/schemas/ocsfv1.8.0ThreatActor_TypeId":{"id":"components/schemas/ocsfv1.8.0ThreatActor_TypeId","kind":"json-schema","title":"ocsfv1.8.0ThreatActor_TypeId","data":{"title":"ocsfv1.8.0ThreatActor_TypeId","type":"integer","description":"ThreatActorTypeId is an enum, and the following values are allowed.\n0 - Unknown: The threat actor type is unknown.\n1 - state\n2 - Cybercriminal\n3 - Hacktivists\n4 - Insider\n99 - Other: The threat actor type is not mapped."}},"components/schemas/ocsfv1.8.0Timespan":{"id":"components/schemas/ocsfv1.8.0Timespan","kind":"json-schema","title":"ocsfv1.8.0Timespan","data":{"title":"ocsfv1.8.0Timespan","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Time Span object represents different time period durations. If a timespan is fractional, i.e. crosses one period, e.g. a week and 3 days, more than one may be populated since each member is of integral type. In that case "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if present should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"A timespan may also be defined by its time interval boundaries, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"duration":{"type":"integer","nullable":true,"description":"The duration of the time span in milliseconds."},"duration_days":{"type":"integer","nullable":true,"description":"The duration of the time span in days."},"duration_hours":{"type":"integer","nullable":true,"description":"The duration of the time span in hours."},"duration_mins":{"type":"integer","nullable":true,"description":"The duration of the time span in minutes."},"duration_months":{"type":"integer","nullable":true,"description":"The duration of the time span in months."},"duration_secs":{"type":"integer","nullable":true,"description":"The duration of the time span in seconds."},"duration_weeks":{"type":"integer","nullable":true,"description":"The duration of the time span in weeks."},"duration_years":{"type":"integer","nullable":true,"description":"The duration of the time span in years."},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time or conclusion of the timespan's interval."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time or conclusion of the timespan's interval."},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time or beginning of the timespan's interval."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time or beginning of the timespan's interval."},"type":{"type":"string","nullable":true,"description":"The type of time span duration the object represents."},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Timespan_TypeId","nullable":true,"description":"The normalized identifier for the time span duration type."}}}},"components/schemas/ocsfv1.8.0Timespan_TypeId":{"id":"components/schemas/ocsfv1.8.0Timespan_TypeId","kind":"json-schema","title":"ocsfv1.8.0Timespan_TypeId","data":{"title":"ocsfv1.8.0Timespan_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TimespanTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Milliseconds"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Seconds"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Minutes"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Hours"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Days"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Weeks"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Months"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Years"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - TimeInterval: The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" should be set."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Tls":{"id":"components/schemas/ocsfv1.8.0Tls","kind":"json-schema","title":"ocsfv1.8.0Tls","data":{"title":"ocsfv1.8.0Tls","type":"object","description":"The Transport Layer Security (TLS) object describes the negotiated TLS protocol used for secure communications over an establish network connection.","properties":{"alert":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The integer value of TLS alert if present. The alerts are defined in the TLS specification in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc2246"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RFC-2246"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"certificate":{"$ref":"#/components/schemas/ocsfv1.8.0Certificate","nullable":true,"description":"The certificate object containing information about the digital certificate."},"certificate_chain":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The Chain of Certificate Serial Numbers field provides a chain of Certificate Issuer Serial Numbers leading to the Root Certificate Issuer."},"cipher":{"type":"string","nullable":true,"description":"The negotiated cipher suite."},"client_ciphers":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The client cipher suites that were exchanged during the TLS handshake negotiation."},"extension_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0TlsExtension"},"nullable":true,"description":"The list of TLS extensions."},"handshake_dur":{"type":"integer","nullable":true,"description":"The amount of total time for the TLS handshake to complete after the TCP connection is established, including client-side delays, in milliseconds."},"ja3_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":"The MD5 hash of a JA3 string."},"ja3s_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":"The MD5 hash of a JA3S string."},"key_length":{"type":"integer","nullable":true,"description":"The length of the encryption key."},"sans":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0San"},"nullable":true,"description":"The list of subject alternative names that are secured by a specific certificate."},"server_ciphers":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The server cipher suites that were exchanged during the TLS handshake negotiation."},"sni":{"type":"string","nullable":true,"description":" The Server Name Indication (SNI) extension sent by the client."},"tls_extension_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0TlsExtension"},"nullable":true,"description":"The list of TLS extensions."},"version":{"type":"string","description":"The TLS protocol version."}},"required":["version"]}},"components/schemas/ocsfv1.8.0TlsExtension":{"id":"components/schemas/ocsfv1.8.0TlsExtension","kind":"json-schema","title":"ocsfv1.8.0TlsExtension","data":{"title":"ocsfv1.8.0TlsExtension","type":"object","description":"The TLS Extension object describes additional attributes that extend the base Transport Layer Security (TLS) object.","properties":{"data":{"nullable":true,"description":"The data contains information specific to the particular extension type."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The TLS extension type. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Server Name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0TlsExtension_TypeId","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The TLS extension type identifier. See "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://datatracker.ietf.org/doc/html/rfc8446#page-35"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Transport Layer Security (TLS) extension page"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["type_id"]}},"components/schemas/ocsfv1.8.0TlsExtension_TypeId":{"id":"components/schemas/ocsfv1.8.0TlsExtension_TypeId","kind":"json-schema","title":"ocsfv1.8.0TlsExtension_TypeId","data":{"title":"ocsfv1.8.0TlsExtension_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TlsExtensionTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - name: The Server Name Indication extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - fragment_length: The Maximum Fragment Length Negotiation extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - request: The Certificate Status Request extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - groups: The Supported Groups extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - algorithms: The Signature Algorithms extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - srtp: The Use SRTP data protection extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - heartbeat: The Heartbeat extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - layer_protocol_negotiation: The Application-Layer Protocol Negotiation extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - certificate_timestamp: The Signed Certificate Timestamp extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - certificate_type: The Client Certificate Type extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - certificate_type: The Server Certificate Type extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - padding: The Padding extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"41 - shared_key: The Pre Shared Key extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"42 - data: The Early Data extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"43 - versions: The Supported Versions extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"44 - cookie: The Cookie extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"45 - key_exchange_modes: The Pre-Shared Key Exchange Modes extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"47 - authorities: The Certificate Authorities extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"48 - filters: The OID Filters extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"49 - handshake_auth: The Post-Handshake Client Authentication extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"50 - algorithms_cert: The Signature Algorithms extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"51 - share: The Key Share extension."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Token":{"id":"components/schemas/ocsfv1.8.0Token","kind":"json-schema","title":"ocsfv1.8.0Token","data":{"title":"ocsfv1.8.0Token","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Token object is the base object for representing tokens, API keys, and authentication credentials used across different contexts. This object provides common attributes for all token types, including protocol-specific authentication tokens (Kerberos, OIDC, SAML) and API/client tokens used for service authentication. When to use this object: Use the base "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"token"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object directly in API activity events to represent API tokens, client tokens, or API keys used to authenticate API requests. Examples include: Okta API tokens, Microsoft Entra ID Application Registration client secrets, Stripe API keys, AWS API keys. When NOT to use this object: Do NOT use the base "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"token"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object for protocol-specific authentication tokens in authentication events - use "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authentication_token"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" instead (which extends this object). Do NOT use "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"token"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for tracking credential lifecycle and usage patterns - use "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"programmatic_credential"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" instead."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time that the token was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time that the token was created."},"expiration_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The expiration time of the token."},"expiration_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The expiration time of the token."},"is_renewable":{"type":"boolean","nullable":true,"description":"Indicates whether the token is renewable."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The last time the token was updated."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The last time the token was updated."},"name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The human-friendly name of a token or key, if available, such as the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from the Okta API Token API."},"children":[],"type":"text"}],"type":"paragraph"}]},"tenant_uid":{"type":"string","nullable":true,"description":"The unique identifier of the tenant or organization that owns the token or key, or the tenant context in which the token is authorized for use. This is particularly relevant in multi-tenant Identity Provider scenarios where tokens are scoped to specific tenants."},"type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type of the token, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. This indicates whether the token is a Client Token, API Token, or one of the protocol-specific token types."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0Token_TypeId","nullable":true,"description":"The normalized token type identifier. Valid values: 0 (Unknown), 1 (Ticket Granting Ticket - Kerberos), 2 (Service Ticket - Kerberos), 3 (Identity Token - OIDC), 4 (Refresh Token - OIDC), 5 (SAML Assertion), 6 (Client Token - IdP-issued), 7 (API Token - generic API keys), 99 (Other)."},"uid":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The unique ID of a token or key, if available, such as the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Secret ID"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of Entra ID Application Registration Client Secrets."},"children":[],"type":"text"}],"type":"paragraph"}]},"zone":{"type":"string","nullable":true,"description":"The network zone or geographic region that the token or key is authorized to be used from. This may represent network-based access restrictions, geographic limitations, or other zone-based authorization policies. Examples include Okta's network zone restrictions or cloud provider region restrictions."}}}},"components/schemas/ocsfv1.8.0Token_TypeId":{"id":"components/schemas/ocsfv1.8.0Token_TypeId","kind":"json-schema","title":"ocsfv1.8.0Token_TypeId","data":{"title":"ocsfv1.8.0Token_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TokenTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The token type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - TicketGrantingTicket: Ticket Granting Ticket (TGT) for Kerberos."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - ServiceTicket: Service Ticket (ST) for Kerberos."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - IdentityToken: Identity (ID) Token for OIDC."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - RefreshToken: Refresh Token for OIDC."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - SAMLAssertion: Authentication Assertion for SAML."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - ClientToken: Client Token issued by an Identity Provider (IdP) for application authentication. Use this value for IdP-issued tokens used for service-to-service authentication. Examples: Microsoft Entra ID Application Registration client secrets, Okta API tokens, Auth0 Machine-to-Machine tokens. Key characteristic: These tokens are issued by Identity Providers, not by individual services."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - APIToken: A generic API token or API key used for authenticating API requests. Use this value for service-specific API authentication tokens that are NOT issued by Identity Providers. Examples: REST API keys, GraphQL API keys, Stripe API keys, Twilio API keys, AWS API keys. Key characteristic: These tokens are issued by individual services/platforms, not by Identity Providers."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0TrainingCampaign":{"id":"components/schemas/ocsfv1.8.0TrainingCampaign","kind":"json-schema","title":"ocsfv1.8.0TrainingCampaign","data":{"title":"ocsfv1.8.0TrainingCampaign","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Training Campaign object describes a security awareness training assignment container that targets users or groups with one or more training content items and yields enrollments. Examples include a KnowBe4 training campaign or an enrollment batch. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note:"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" This object is distinct from the core threat-actor "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"campaign"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object and from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"phishing_program"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}],"properties":{"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the training campaign was known to have been created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the training campaign was known to have been created."},"desc":{"type":"string","nullable":true,"description":"The description of the training campaign."},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the training campaign is scheduled to end or actually ended."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the training campaign is scheduled to end or actually ended."},"enrollments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrollment"},"nullable":true,"description":"The enrollments for the training campaign."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Group"},"nullable":true,"description":"The groups targeted by the training campaign."},"modified_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the training campaign was known to have been modified."},"modified_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the training campaign was known to have been modified."},"name":{"type":"string","nullable":true,"description":"The name of the entity."},"num_completed":{"type":"integer","nullable":true,"description":"The number of users who have completed a training campaign."},"num_enrolled":{"type":"integer","nullable":true,"description":"The number of users who are enrolled in a training campaign."},"num_overdue":{"type":"integer","nullable":true,"description":"The number of users who have not completed the training campaign by the due date."},"percent_complete":{"type":"number","format":"double","nullable":true,"description":"The percentage of the training campaign that has been completed. This is a value between 0.0 and 100.0."},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time the training campaign is scheduled to start or actually started."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time the training campaign is scheduled to start or actually started."},"state":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The state of the training campaign, normalized to the caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". In the case of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Other"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"state_id":{"$ref":"#/components/schemas/ocsfv1.8.0TrainingCampaign_StateId","nullable":true,"description":"The normalized state of the training campaign."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the training campaign."}}}},"components/schemas/ocsfv1.8.0TrainingCampaign_StateId":{"id":"components/schemas/ocsfv1.8.0TrainingCampaign_StateId","kind":"json-schema","title":"ocsfv1.8.0TrainingCampaign_StateId","data":{"title":"ocsfv1.8.0TrainingCampaign_StateId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TrainingCampaignStateId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The state is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Draft: The training campaign is a draft."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Building: The training campaign is building."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Scheduled: The training campaign is scheduled to start."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Active: The training campaign is active."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Completed: The training campaign is completed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Canceled: The training campaign is canceled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The state is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"state"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Trait":{"id":"components/schemas/ocsfv1.8.0Trait","kind":"json-schema","title":"ocsfv1.8.0Trait","data":{"title":"ocsfv1.8.0Trait","type":"object","description":"Describes a characteristic or feature of an entity that was observed. For example, this object can be used to represent specific characteristics derived from events or findings that can be surfaced as distinguishing traits of the entity in question.","properties":{"category":{"type":"string","nullable":true,"description":"The high-level grouping or classification this trait belongs to."},"name":{"type":"string","nullable":true,"description":"The name of the trait."},"type":{"type":"string","nullable":true,"description":"The type of the trait. For example, this can be used to indicate if the trait acts as a contributing factor (increases risk/severity) or a mitigating factor (decreases risk/severity), in the context of the related finding."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the trait."},"values":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The values of the trait."}}}},"components/schemas/ocsfv1.8.0TransformationInfo":{"id":"components/schemas/ocsfv1.8.0TransformationInfo","kind":"json-schema","title":"ocsfv1.8.0TransformationInfo","data":{"title":"ocsfv1.8.0TransformationInfo","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The transformation_info object represents the mapping or transformation used."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"lang":{"type":"string","nullable":true,"description":"The transformation language used to transform the data."},"name":{"type":"string","nullable":true,"description":"The name of the transformation or mapping."},"product":{"$ref":"#/components/schemas/ocsfv1.8.0Product","nullable":true,"description":"The product or instance used to make the transformation"},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"Time of the transformation."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"Time of the transformation."},"uid":{"type":"string","nullable":true,"description":"The unique identifier of the mapping or transformation."},"url_string":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":"The Uniform Resource Locator String where the mapping or transformation exists."}}}},"components/schemas/ocsfv1.8.0Url":{"id":"components/schemas/ocsfv1.8.0Url","kind":"json-schema","title":"ocsfv1.8.0Url","data":{"title":"ocsfv1.8.0Url","type":"object","description":"The Uniform Resource Locator (URL) object describes the characteristics of a URL.","properties":{"categories":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Website categorization names, as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"category_ids"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" enum values."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_ids":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Url_CategoryIds"},"nullable":true,"description":"The Website categorization identifiers."},"domain":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The domain portion of the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://sub.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"hostname":{"$ref":"#/components/schemas/ocsfv1.8.0Hostname","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL host as extracted from the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"www.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"www.example.com/download/trouble"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"path":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL path as extracted from the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"/download/trouble"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"www.example.com/download/trouble"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"port":{"$ref":"#/components/schemas/ocsfv1.8.0Port","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL port. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"80"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"query_string":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The query portion of the URL. For example: the query portion of the URL "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http://www.example.com/search?q=bad&sort=date"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"q=bad&sort=date"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"resource_type":{"type":"string","nullable":true,"description":"The context in which a resource was retrieved in a web request."},"scheme":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The scheme portion of the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ftp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"sftp"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"subdomain":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The subdomain portion of the URL. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"sub"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://sub.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"sub2.sub1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"https://sub2.sub1.example.com"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"url_string":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL string. See RFC 1738. For example: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"http://www.example.com/download/trouble.exe"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". Note: The URL path should not populate the URL string."},"children":[],"type":"text"}],"type":"paragraph"}]}}}},"components/schemas/ocsfv1.8.0Url_CategoryIds":{"id":"components/schemas/ocsfv1.8.0Url_CategoryIds","kind":"json-schema","title":"ocsfv1.8.0Url_CategoryIds","data":{"title":"ocsfv1.8.0Url_CategoryIds","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UrlCategoryIds is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The Domain/URL category is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - MatureContent"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Pornography"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - SexEducation"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Swimsuit"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Nudity"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Extreme"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Questionable_Illegal"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Gambling"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Hate_Racism"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Weapons"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - Abortion"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Hacking"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Phishing"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Entertainment"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Economy"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Belief"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Alcohol"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - Tobacco"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - ControlledSubstances"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - ChildPornography"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Education"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"29 - CharitableOrganizations"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"30 - Culture"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"31 - FinancialServices"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"32 - Trading"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"33 - Games"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"34 - Legal"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"35 - Military"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"36 - SocialAdvocacy"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"37 - Health"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"38 - Internet"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"40 - Portals"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"43 - Malnets"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"44 - Botnets"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"45 - Careers"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"46 - Media"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"47 - Dating"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"49 - Reference"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"50 - PotentiallyAdult"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"51 - IM_SMS"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"52 - Email"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"53 - Forums"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"54 - Religion"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"55 - SocialNetworking"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"56 - Sharing"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"57 - RemoteAccessTools"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"58 - Shopping"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"59 - Auctions"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"60 - RealEstate"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"61 - DailyLiving"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"63 - PersonalSites"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"64 - Dining_Food"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"65 - Recreation"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"66 - Travel"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"67 - Vehicles"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"68 - Jokes"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"71 - SoftwareDownloads"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"83 - to_Peer_P2P_"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"84 - VideoClips"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"85 - BusinessApplications"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"86 - ProxyAvoidance"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"87 - ForKids"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"88 - Analytics"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"89 - WebHosting"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"90 - Uncategorized"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"92 - Suspicious"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"93 - SexualExpression"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"95 - Translation"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"96 - Viewable_Infrastructure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"97 - ContentServers"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"98 - Placeholders"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The Domain/URL category is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"categories"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"101 - Spam"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"102 - PotentiallyUnwantedSoftware"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"103 - DynamicDNSHost"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"106 - Card_Invitations"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"107 - Informational"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"108 - InformationSecurity"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"109 - InternetConnectedDevices"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"110 - InternetTelephony"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"111 - OnlineMeetings"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"112 - MediaSharing"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"113 - AudioStreams"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"114 - VideoStreams"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"118 - CopyrightConcerns"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"121 - Marijuana"},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0User":{"id":"components/schemas/ocsfv1.8.0User","kind":"json-schema","title":"ocsfv1.8.0User","data":{"title":"ocsfv1.8.0User","type":"object","description":"The User object describes the characteristics of a user/person or a security principal.","properties":{"account":{"$ref":"#/components/schemas/ocsfv1.8.0Account","nullable":true,"description":"The user's account or the account associated with the user."},"credential_uid":{"type":"string","nullable":true,"description":"The unique identifier of the user's credential. For example, AWS Access Key ID."},"display_name":{"type":"string","nullable":true,"description":"The display name of the user, as reported by the product."},"domain":{"type":"string","nullable":true,"description":"The domain where the user is defined. For example: the LDAP or Active Directory domain."},"email_addr":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress","nullable":true,"description":"The user's primary email address."},"enrollments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrollment"},"nullable":true,"description":"The list of security awareness training enrollments for the user."},"forward_addr":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress","nullable":true,"description":"The user's forwarding email address."},"full_name":{"type":"string","nullable":true,"description":"The full name of the user, as reported by the product."},"groups":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Group"},"nullable":true,"description":"The administrative groups to which the user belongs."},"has_mfa":{"type":"boolean","nullable":true,"description":"The user has a multi-factor or secondary-factor device assigned."},"ldap_person":{"$ref":"#/components/schemas/ocsfv1.8.0LdapPerson","nullable":true,"description":"The additional LDAP attributes that describe a person."},"name":{"$ref":"#/components/schemas/ocsfv1.8.0UserName","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The username. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"janedoe1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"org":{"$ref":"#/components/schemas/ocsfv1.8.0Organization","nullable":true,"description":"Organization and org unit related to the user."},"phone_number":{"type":"string","nullable":true,"description":"The telephone number of the user."},"programmatic_credentials":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ProgrammaticCredential"},"nullable":true,"description":"Details about the programmatic credential (API keys, access tokens, certificates, etc) associated to the user."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0User_RiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"type":{"type":"string","nullable":true,"description":"The type of the user. For example, System, AWS IAM User, etc."},"type_id":{"$ref":"#/components/schemas/ocsfv1.8.0User_TypeId","nullable":true,"description":"The account type identifier."},"uid":{"type":"string","nullable":true,"description":"The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN."},"uid_alt":{"type":"string","nullable":true,"description":"The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID."}}}},"components/schemas/ocsfv1.8.0User_RiskLevelId":{"id":"components/schemas/ocsfv1.8.0User_RiskLevelId","kind":"json-schema","title":"ocsfv1.8.0User_RiskLevelId","data":{"title":"ocsfv1.8.0User_RiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UserRiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0User_TypeId":{"id":"components/schemas/ocsfv1.8.0User_TypeId","kind":"json-schema","title":"ocsfv1.8.0User_TypeId","data":{"title":"ocsfv1.8.0User_TypeId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"UserTypeId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The type is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - User: Regular user account."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Admin: Admin/root user account."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - System: System account. For example, Windows computer accounts with a trailing dollar sign ($)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Service: Service account. For example, Windows service account."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The type is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"type"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0VendorAttributes":{"id":"components/schemas/ocsfv1.8.0VendorAttributes","kind":"json-schema","title":"ocsfv1.8.0VendorAttributes","data":{"title":"ocsfv1.8.0VendorAttributes","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The finding severity, as reported by the Vendor (Finding Provider). The value should be normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0VendorAttributes_SeverityId","nullable":true,"description":"The finding severity ID, as reported by the Vendor (Finding Provider)."}}}},"components/schemas/ocsfv1.8.0VendorAttributes_SeverityId":{"id":"components/schemas/ocsfv1.8.0VendorAttributes_SeverityId","kind":"json-schema","title":"ocsfv1.8.0VendorAttributes_SeverityId","data":{"title":"ocsfv1.8.0VendorAttributes_SeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"VendorAttributesSeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Vulnerability":{"id":"components/schemas/ocsfv1.8.0Vulnerability","kind":"json-schema","title":"ocsfv1.8.0Vulnerability","data":{"title":"ocsfv1.8.0Vulnerability","type":"object","description":"The vulnerability is an unintended characteristic of a computing component or system configuration that multiplies the risk of an adverse event or a loss occurring either due to accidental exposure, deliberate attack, or conflict with new system components.","properties":{"advisory":{"$ref":"#/components/schemas/ocsfv1.8.0Advisory","nullable":true,"description":"Detail about the security advisory, that is used to publicly disclose cybersecurity vulnerabilities by a vendor."},"affected_code":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0AffectedCode"},"nullable":true,"description":"List of Affected Code objects that describe details about code blocks identified as vulnerable."},"affected_packages":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0AffectedPackage"},"nullable":true,"description":"List of software packages identified as affected by a vulnerability/vulnerabilities."},"category":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The category of a vulnerability or weakness, as reported by the source tool, such as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Container Security"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Open Source Security"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"cve":{"$ref":"#/components/schemas/ocsfv1.8.0Cve","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the Common Vulnerabilities and Exposures "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cve.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"(CVE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" details related to the vulnerability."},"children":[],"type":"text"}],"type":"paragraph"}]},"cwe":{"$ref":"#/components/schemas/ocsfv1.8.0Cwe","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the Common Weakness Enumeration "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://cwe.mitre.org/"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"(CWE)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" details related to the vulnerability."},"children":[],"type":"text"}],"type":"paragraph"}]},"dependency_chain":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Information about the chain of dependencies related to the issue as reported by an Application Security or Vulnerability Management tool. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"serverless-offline -> @serverless/utils -> memoizee -> es5-ext"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"desc":{"type":"string","nullable":true,"description":"The description of the vulnerability."},"exploit_last_seen_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the exploit was most recently observed."},"exploit_last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the exploit was most recently observed."},"exploit_maturity_levels":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ExploitMaturityLevel"},"nullable":true,"description":"The list of exploit maturity levels for the vulnerability."},"exploit_ref_url":{"$ref":"#/components/schemas/ocsfv1.8.0URLString","nullable":true,"description":"The URL of the exploit code or Proof-of-Concept (PoC)."},"exploit_requirement":{"type":"string","nullable":true,"description":"The requirement description related to any constraints around exploit execution."},"exploit_type":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The categorization or type of Exploit. E.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Network"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Physical"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"first_seen_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the vulnerability was first observed."},"first_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the vulnerability was first observed."},"fix_available":{"type":"boolean","nullable":true,"description":"Indicates if a fix is available for the reported vulnerability."},"fix_coverage":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The fix coverage, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"fix_coverage_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value."},"children":[],"type":"text"}],"type":"paragraph"}]},"fix_coverage_id":{"$ref":"#/components/schemas/ocsfv1.8.0Vulnerability_FixCoverageId","nullable":true,"description":"The normalized identifier for fix coverage, applicable to this vulnerability. Typically useful, when there are multiple affected packages but only a subset have available fixes."},"is_exploit_available":{"type":"boolean","nullable":true,"description":"Indicates if an exploit or a PoC (proof-of-concept) is available for the reported vulnerability."},"is_fix_available":{"type":"boolean","nullable":true,"description":"Indicates if a fix is available for the reported vulnerability."},"is_reachable":{"type":"boolean","nullable":true,"description":"Indicates if the vulnerability is known to be reachable. When the vulnerability is located inside of an application security posture finding event, a vulnerability is considered reachable if there is a direct or indirect path from the applications code to the vulnerable code."},"kb_article_list":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0KbArticle"},"nullable":true,"description":"A list of KB articles or patches related to an endpoint. A KB Article contains metadata that describes the patch or an update."},"kb_articles":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The KB article/s related to the entity. A KB Article contains metadata that describes the patch or an update."},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time when the vulnerability was most recently observed."},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time when the vulnerability was most recently observed."},"packages":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Package"},"nullable":true,"description":"List of vulnerable packages as identified by the security product"},"references":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of reference URLs with additional information about the vulnerability."},"related_vulnerabilities":{"type":"array","items":{"type":"string"},"nullable":true,"description":"List of vulnerability IDs (e.g. CVE ID) that are related to this vulnerability."},"remediation":{"$ref":"#/components/schemas/ocsfv1.8.0Remediation","nullable":true,"description":"The remediation recommendations on how to mitigate the identified vulnerability."},"severity":{"type":"string","nullable":true,"description":"The vendor assigned severity of the vulnerability."},"title":{"type":"string","nullable":true,"description":"A title or a brief phrase summarizing the discovered vulnerability."},"vendor_name":{"type":"string","nullable":true,"description":"The name of the vendor that identified the vulnerability."},"xattributes":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"An unordered collection of zero or more name/value pairs that represent a vulnerability's extended attributes and are specific to the event source."}}}},"components/schemas/ocsfv1.8.0Vulnerability_FixCoverageId":{"id":"components/schemas/ocsfv1.8.0Vulnerability_FixCoverageId","kind":"json-schema","title":"ocsfv1.8.0Vulnerability_FixCoverageId","data":{"title":"ocsfv1.8.0Vulnerability_FixCoverageId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"VulnerabilityFixCoverageId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The fix coverage is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Complete: All affected packages and components have available fixes or patches to remediate the vulnerability."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Partial: Only some of the affected packages and components have available fixes or patches, while others remain vulnerable."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - None: No fixes or patches are currently available for any of the affected packages and components."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The fix coverage is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"fix_coverage"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0Whois":{"id":"components/schemas/ocsfv1.8.0Whois","kind":"json-schema","title":"ocsfv1.8.0Whois","data":{"title":"ocsfv1.8.0Whois","type":"object","description":"The resources of a WHOIS record for a given domain. This can include domain names, IP address blocks, autonomous system information, and/or contact and registration information for a domain.","properties":{"autonomous_system":{"$ref":"#/components/schemas/ocsfv1.8.0AutonomousSystem","nullable":true,"description":"The autonomous system information associated with a domain."},"created_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"When the domain was registered or WHOIS entry was created."},"created_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"When the domain was registered or WHOIS entry was created."},"dnssec_status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized value of dnssec_status_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"dnssec_status_id":{"$ref":"#/components/schemas/ocsfv1.8.0Whois_DnssecStatusId","nullable":true,"description":"Describes the normalized status of DNS Security Extensions (DNSSEC) for a domain."},"domain":{"type":"string","nullable":true,"description":"The domain name corresponding to the WHOIS record."},"domain_contacts":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0DomainContact"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Domain Contact"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" objects."},"children":[],"type":"text"}],"type":"paragraph"}]},"email_addr":{"$ref":"#/components/schemas/ocsfv1.8.0EmailAddress","nullable":true,"description":"The email address for the registrar's abuse contact"},"isp":{"type":"string","nullable":true,"description":"The name of the Internet Service Provider (ISP)."},"isp_org":{"type":"string","nullable":true,"description":"The organization name of the Internet Service Provider (ISP). This represents the parent organization or company that owns/operates the ISP. For example, Comcast Corporation would be the ISP org for Xfinity internet service. This attribute helps identify the ultimate provider when ISPs operate under different brand names."},"last_seen_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"When the WHOIS record was last updated or seen at."},"last_seen_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"When the WHOIS record was last updated or seen at."},"name_servers":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A collection of name servers related to a domain registration or other record."},"phone_number":{"type":"string","nullable":true,"description":"The phone number for the registrar's abuse contact"},"registrar":{"type":"string","nullable":true,"description":"The domain registrar."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The status of a domain and its ability to be transferred, e.g., "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"clientTransferProhibited"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"subdomains":{"type":"array","items":{"type":"string"},"nullable":true,"description":"An array of subdomain strings. Can be used to collect several subdomains such as those from Domain Generation Algorithms (DGAs)."},"subnet":{"$ref":"#/components/schemas/ocsfv1.8.0Subnet","nullable":true,"description":"The IP address block (CIDR) associated with a domain."}}}},"components/schemas/ocsfv1.8.0Whois_DnssecStatusId":{"id":"components/schemas/ocsfv1.8.0Whois_DnssecStatusId","kind":"json-schema","title":"ocsfv1.8.0Whois_DnssecStatusId","data":{"title":"ocsfv1.8.0Whois_DnssecStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"WhoisDnssecStatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Signed: The related domain enables the signing of DNS records using DNSSEC."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Unsigned: The related domain does not enable the signing of DNS records using DNSSEC."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The DNSSEC status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"dnssec_status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0osintinventoryinfoActivityId":{"id":"components/schemas/ocsfv1.8.0osintinventoryinfoActivityId","kind":"json-schema","title":"ocsfv1.8.0osintinventoryinfoActivityId","data":{"title":"ocsfv1.8.0osintinventoryinfoActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Log: The discovered information is via a log."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Collect: The discovered information is via a collection process."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0osintinventoryinfoCategoryUid":{"id":"components/schemas/ocsfv1.8.0osintinventoryinfoCategoryUid","kind":"json-schema","title":"ocsfv1.8.0osintinventoryinfoCategoryUid","data":{"title":"ocsfv1.8.0osintinventoryinfoCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects."}},"components/schemas/ocsfv1.8.0osintinventoryinfoClassUid":{"id":"components/schemas/ocsfv1.8.0osintinventoryinfoClassUid","kind":"json-schema","title":"ocsfv1.8.0osintinventoryinfoClassUid","data":{"title":"ocsfv1.8.0osintinventoryinfoClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n5021 - OSINTInventoryInfo: OSINT Inventory Info events report open source intelligence or threat intelligence inventory data that is either logged or proactively collected. For example, when collecting OSINT information from Threat Intelligence Platforms (TIPs) or Extended Detection and Response (XDR) platforms, or collecting data from OSINT or other generic threat intelligence and enrichment feeds such as APIs and datastores."}},"components/schemas/ocsfv1.8.0osintinventoryinfoOsintInventoryInfo":{"id":"components/schemas/ocsfv1.8.0osintinventoryinfoOsintInventoryInfo","kind":"json-schema","title":"ocsfv1.8.0osintinventoryinfoOsintInventoryInfo","data":{"title":"ocsfv1.8.0osintinventoryinfoOsintInventoryInfo","type":"object","description":"OSINT Inventory Info events report open source intelligence or threat intelligence inventory data that is either logged or proactively collected. For example, when collecting OSINT information from Threat Intelligence Platforms (TIPs) or Extended Detection and Response (XDR) platforms, or collecting data from OSINT or other generic threat intelligence and enrichment feeds such as APIs and datastores.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0osintinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.8.0Actor","nullable":true,"description":"The actor describes the process that was the source of the inventory activity. In the case of OSINT inventory data, that could be a particular process or script that is run to scrape the OSINT or threat intelligence data. For example, it could be a Python process that runs to pull data from a MISP or Shodan API."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0osintinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0osintinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Osint"},"description":"The OSINT that is being discovered by an inventory process."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0osintinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0osintinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0osintinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","osint","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0osintinventoryinfoSeverityId":{"id":"components/schemas/ocsfv1.8.0osintinventoryinfoSeverityId","kind":"json-schema","title":"ocsfv1.8.0osintinventoryinfoSeverityId","data":{"title":"ocsfv1.8.0osintinventoryinfoSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0osintinventoryinfoStatusId":{"id":"components/schemas/ocsfv1.8.0osintinventoryinfoStatusId","kind":"json-schema","title":"ocsfv1.8.0osintinventoryinfoStatusId","data":{"title":"ocsfv1.8.0osintinventoryinfoStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0osintinventoryinfoTypeUid":{"id":"components/schemas/ocsfv1.8.0osintinventoryinfoTypeUid","kind":"json-schema","title":"ocsfv1.8.0osintinventoryinfoTypeUid","data":{"title":"ocsfv1.8.0osintinventoryinfoTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n502100 - Unknown\n502101 - Log: The discovered information is via a log.\n502102 - Collect: The discovered information is via a collection process.\n502199 - Other"}},"components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoActivityId":{"id":"components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoActivityId","kind":"json-schema","title":"ocsfv1.8.0phishingsimulationinventoryinfoActivityId","data":{"title":"ocsfv1.8.0phishingsimulationinventoryinfoActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Log: The discovered information is via a log."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Collect: The discovered information is via a collection process."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoCategoryUid":{"id":"components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoCategoryUid","kind":"json-schema","title":"ocsfv1.8.0phishingsimulationinventoryinfoCategoryUid","data":{"title":"ocsfv1.8.0phishingsimulationinventoryinfoCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects."}},"components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoClassUid":{"id":"components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoClassUid","kind":"json-schema","title":"ocsfv1.8.0phishingsimulationinventoryinfoClassUid","data":{"title":"ocsfv1.8.0phishingsimulationinventoryinfoClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n98905003 - PhishingSimulationInventoryInfo: Phishing Simulation Inventory Info events report phishing program, simulation run, and/or template inventory data that is either logged or proactively collected from a security awareness training platform. These events describe security awareness-testing programs, campaigns, or campaign runs that are either logged or proactively collected, not malicious threat-actor campaigns."}},"components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoPhishingSimulationInventoryInfo":{"id":"components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoPhishingSimulationInventoryInfo","kind":"json-schema","title":"ocsfv1.8.0phishingsimulationinventoryinfoPhishingSimulationInventoryInfo","data":{"title":"ocsfv1.8.0phishingsimulationinventoryinfoPhishingSimulationInventoryInfo","type":"object","description":"Phishing Simulation Inventory Info events report phishing program, simulation run, and/or template inventory data that is either logged or proactively collected from a security awareness training platform. These events describe security awareness-testing programs, campaigns, or campaign runs that are either logged or proactively collected, not malicious threat-actor campaigns.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"phishing_program":{"$ref":"#/components/schemas/ocsfv1.8.0PhishingProgram","nullable":true,"description":"The phishing program that the phishing simulation belongs to."},"phishing_simulation":{"$ref":"#/components/schemas/ocsfv1.8.0PhishingSimulation","description":"The simulated phishing simulation that was discovered."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the phishing simulation's creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the phishing simulation's creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","phishing_simulation","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoSeverityId":{"id":"components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoSeverityId","kind":"json-schema","title":"ocsfv1.8.0phishingsimulationinventoryinfoSeverityId","data":{"title":"ocsfv1.8.0phishingsimulationinventoryinfoSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoStatusId":{"id":"components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoStatusId","kind":"json-schema","title":"ocsfv1.8.0phishingsimulationinventoryinfoStatusId","data":{"title":"ocsfv1.8.0phishingsimulationinventoryinfoStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoTypeUid":{"id":"components/schemas/ocsfv1.8.0phishingsimulationinventoryinfoTypeUid","kind":"json-schema","title":"ocsfv1.8.0phishingsimulationinventoryinfoTypeUid","data":{"title":"ocsfv1.8.0phishingsimulationinventoryinfoTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n9890500300 - Unknown\n9890500301 - Log: The discovered information is via a log.\n9890500302 - Collect: The discovered information is via a collection process.\n9890500399 - Other"}},"components/schemas/ocsfv1.8.0scanactivityActionId":{"id":"components/schemas/ocsfv1.8.0scanactivityActionId","kind":"json-schema","title":"ocsfv1.8.0scanactivityActionId","data":{"title":"ocsfv1.8.0scanactivityActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Observed: The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Modified: The activity was modified, adjusted, or corrected. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0scanactivityActivityId":{"id":"components/schemas/ocsfv1.8.0scanactivityActivityId","kind":"json-schema","title":"ocsfv1.8.0scanactivityActivityId","data":{"title":"ocsfv1.8.0scanactivityActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Started: The scan was started."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Completed: The scan was completed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Cancelled: The scan was cancelled."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - DurationViolation: The allocated scan time was insufficient to complete the requested scan."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - PauseViolation: The scan was paused, either by the user or by program constraints (e.g. scans that are suspended during certain time intervals), and not resumed within the allotted time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Error: The scan could not be completed due to an internal error."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - Paused: The scan was paused."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Resumed: The scan was resumed from the pause point."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restarted: The scan restarted from the beginning of the file enumeration."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Delayed: The user delayed the scan."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0scanactivityCategoryUid":{"id":"components/schemas/ocsfv1.8.0scanactivityCategoryUid","kind":"json-schema","title":"ocsfv1.8.0scanactivityCategoryUid","data":{"title":"ocsfv1.8.0scanactivityCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n6 - ApplicationActivity: Application Activity events report detailed information about the behavior of applications and services."}},"components/schemas/ocsfv1.8.0scanactivityClassUid":{"id":"components/schemas/ocsfv1.8.0scanactivityClassUid","kind":"json-schema","title":"ocsfv1.8.0scanactivityClassUid","data":{"title":"ocsfv1.8.0scanactivityClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n6007 - ScanActivity: Scan events report the start, completion, and results of a scan job. The scan event includes the number of items that were scanned and the number of detections that were resolved."}},"components/schemas/ocsfv1.8.0scanactivityConfidenceId":{"id":"components/schemas/ocsfv1.8.0scanactivityConfidenceId","kind":"json-schema","title":"ocsfv1.8.0scanactivityConfidenceId","data":{"title":"ocsfv1.8.0scanactivityConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0scanactivityDispositionId":{"id":"components/schemas/ocsfv1.8.0scanactivityDispositionId","kind":"json-schema","title":"ocsfv1.8.0scanactivityDispositionId","data":{"title":"ocsfv1.8.0scanactivityDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0scanactivityRiskLevelId":{"id":"components/schemas/ocsfv1.8.0scanactivityRiskLevelId","kind":"json-schema","title":"ocsfv1.8.0scanactivityRiskLevelId","data":{"title":"ocsfv1.8.0scanactivityRiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0scanactivityScanActivity":{"id":"components/schemas/ocsfv1.8.0scanactivityScanActivity","kind":"json-schema","title":"ocsfv1.8.0scanactivityScanActivity","data":{"title":"ocsfv1.8.0scanactivityScanActivity","type":"object","description":"Scan events report the start, completion, and results of a scan job. The scan event includes the number of items that were scanned and the number of detections that were resolved.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivityActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivityActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.8.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Application Activity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivityCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivityClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"command_uid":{"type":"string","nullable":true,"description":"The command identifier that is associated with this scan event.  This ID uniquely identifies the proactive scan command, e.g., if remotely initiated."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivityConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"device":{"$ref":"#/components/schemas/ocsfv1.8.0Device","nullable":true,"description":"An addressable device, computer system or host."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivityDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":"The duration of the scan"},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of the scan job."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of the scan job."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"num_detections":{"type":"integer","nullable":true,"description":"The number of detections."},"num_files":{"type":"integer","nullable":true,"description":"The number of files scanned."},"num_folders":{"type":"integer","nullable":true,"description":"The number of folders scanned."},"num_network_items":{"type":"integer","nullable":true,"description":"The number of network items scanned."},"num_processes":{"type":"integer","nullable":true,"description":"The number of processes scanned."},"num_registry_items":{"type":"integer","nullable":true,"description":"The number of registry items scanned."},"num_resolutions":{"type":"integer","nullable":true,"description":"The number of items that were resolved."},"num_skipped_items":{"type":"integer","nullable":true,"description":"The number of skipped items."},"num_trusted_items":{"type":"integer","nullable":true,"description":"The number of trusted items."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy associated with this Scan event; required if the scan was initiated by a policy."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivityRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"scan":{"$ref":"#/components/schemas/ocsfv1.8.0Scan","description":"The Scan object describes characteristics of the scan job."},"schedule_uid":{"type":"string","nullable":true,"description":"The unique identifier of the schedule associated with a scan job."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivitySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of the scan job."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of the scan job."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivityStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"total":{"type":"integer","nullable":true,"description":"The total number of items that were scanned; zero if no items were scanned."},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0scanactivityTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","scan","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0scanactivitySeverityId":{"id":"components/schemas/ocsfv1.8.0scanactivitySeverityId","kind":"json-schema","title":"ocsfv1.8.0scanactivitySeverityId","data":{"title":"ocsfv1.8.0scanactivitySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0scanactivityStatusId":{"id":"components/schemas/ocsfv1.8.0scanactivityStatusId","kind":"json-schema","title":"ocsfv1.8.0scanactivityStatusId","data":{"title":"ocsfv1.8.0scanactivityStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0scanactivityTypeUid":{"id":"components/schemas/ocsfv1.8.0scanactivityTypeUid","kind":"json-schema","title":"ocsfv1.8.0scanactivityTypeUid","data":{"title":"ocsfv1.8.0scanactivityTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n600700 - Unknown\n600701 - Started: The scan was started.\n600702 - Completed: The scan was completed.\n600703 - Cancelled: The scan was cancelled.\n600704 - DurationViolation: The allocated scan time was insufficient to complete the requested scan.\n600705 - PauseViolation: The scan was paused, either by the user or by program constraints (e.g. scans that are suspended during certain time intervals), and not resumed within the allotted time.\n600706 - Error: The scan could not be completed due to an internal error.\n600707 - Paused: The scan was paused.\n600708 - Resumed: The scan was resumed from the pause point.\n600709 - Restarted: The scan restarted from the beginning of the file enumeration.\n600710 - Delayed: The user delayed the scan.\n600799 - Other"}},"components/schemas/ocsfv1.8.0softwareinventoryinfoActionId":{"id":"components/schemas/ocsfv1.8.0softwareinventoryinfoActionId","kind":"json-schema","title":"ocsfv1.8.0softwareinventoryinfoActionId","data":{"title":"ocsfv1.8.0softwareinventoryinfoActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Observed: The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Modified: The activity was modified, adjusted, or corrected. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0softwareinventoryinfoActivityId":{"id":"components/schemas/ocsfv1.8.0softwareinventoryinfoActivityId","kind":"json-schema","title":"ocsfv1.8.0softwareinventoryinfoActivityId","data":{"title":"ocsfv1.8.0softwareinventoryinfoActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Log: The discovered information is via a log."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Collect: The discovered information is via a collection process."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0softwareinventoryinfoCategoryUid":{"id":"components/schemas/ocsfv1.8.0softwareinventoryinfoCategoryUid","kind":"json-schema","title":"ocsfv1.8.0softwareinventoryinfoCategoryUid","data":{"title":"ocsfv1.8.0softwareinventoryinfoCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects."}},"components/schemas/ocsfv1.8.0softwareinventoryinfoClassUid":{"id":"components/schemas/ocsfv1.8.0softwareinventoryinfoClassUid","kind":"json-schema","title":"ocsfv1.8.0softwareinventoryinfoClassUid","data":{"title":"ocsfv1.8.0softwareinventoryinfoClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n5020 - SoftwareInventoryInfo: Software Inventory Info events report device software inventory data that is either logged or proactively collected. For example, when collecting device information from a CMDB or running a network sweep of connected devices."}},"components/schemas/ocsfv1.8.0softwareinventoryinfoConfidenceId":{"id":"components/schemas/ocsfv1.8.0softwareinventoryinfoConfidenceId","kind":"json-schema","title":"ocsfv1.8.0softwareinventoryinfoConfidenceId","data":{"title":"ocsfv1.8.0softwareinventoryinfoConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0softwareinventoryinfoDispositionId":{"id":"components/schemas/ocsfv1.8.0softwareinventoryinfoDispositionId","kind":"json-schema","title":"ocsfv1.8.0softwareinventoryinfoDispositionId","data":{"title":"ocsfv1.8.0softwareinventoryinfoDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0softwareinventoryinfoRiskLevelId":{"id":"components/schemas/ocsfv1.8.0softwareinventoryinfoRiskLevelId","kind":"json-schema","title":"ocsfv1.8.0softwareinventoryinfoRiskLevelId","data":{"title":"ocsfv1.8.0softwareinventoryinfoRiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0softwareinventoryinfoSeverityId":{"id":"components/schemas/ocsfv1.8.0softwareinventoryinfoSeverityId","kind":"json-schema","title":"ocsfv1.8.0softwareinventoryinfoSeverityId","data":{"title":"ocsfv1.8.0softwareinventoryinfoSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0softwareinventoryinfoSoftwareInfo":{"id":"components/schemas/ocsfv1.8.0softwareinventoryinfoSoftwareInfo","kind":"json-schema","title":"ocsfv1.8.0softwareinventoryinfoSoftwareInfo","data":{"title":"ocsfv1.8.0softwareinventoryinfoSoftwareInfo","type":"object","description":"Software Inventory Info events report device software inventory data that is either logged or proactively collected. For example, when collecting device information from a CMDB or running a network sweep of connected devices.","properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.8.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity. Note that this is not the threat actor of a campaign but may be part of a campaign."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"device":{"$ref":"#/components/schemas/ocsfv1.8.0Device","description":"The device that is being discovered by an inventory process."},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"package":{"$ref":"#/components/schemas/ocsfv1.8.0Package","nullable":true,"description":"The device software that is being discovered by an inventory process."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"product":{"$ref":"#/components/schemas/ocsfv1.8.0Product","nullable":true,"description":"Additional product attributes that have been discovered or enriched from a catalog or other external source."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"sbom":{"$ref":"#/components/schemas/ocsfv1.8.0Sbom","nullable":true,"description":"The Software Bill of Materials (SBOM) of the device software that is being discovered by an inventory process."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0softwareinventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","device","metadata","severity_id","time","type_uid"]}},"components/schemas/ocsfv1.8.0softwareinventoryinfoStatusId":{"id":"components/schemas/ocsfv1.8.0softwareinventoryinfoStatusId","kind":"json-schema","title":"ocsfv1.8.0softwareinventoryinfoStatusId","data":{"title":"ocsfv1.8.0softwareinventoryinfoStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0softwareinventoryinfoTypeUid":{"id":"components/schemas/ocsfv1.8.0softwareinventoryinfoTypeUid","kind":"json-schema","title":"ocsfv1.8.0softwareinventoryinfoTypeUid","data":{"title":"ocsfv1.8.0softwareinventoryinfoTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n502000 - Unknown\n502001 - Log: The discovered information is via a log.\n502002 - Collect: The discovered information is via a collection process.\n502099 - Other"}},"components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoActivityId":{"id":"components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoActivityId","kind":"json-schema","title":"ocsfv1.8.0trainingcampaigninventoryinfoActivityId","data":{"title":"ocsfv1.8.0trainingcampaigninventoryinfoActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Log: The discovered information is via a log."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Collect: The discovered information is via a collection process."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoCategoryUid":{"id":"components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoCategoryUid","kind":"json-schema","title":"ocsfv1.8.0trainingcampaigninventoryinfoCategoryUid","data":{"title":"ocsfv1.8.0trainingcampaigninventoryinfoCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects."}},"components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoClassUid":{"id":"components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoClassUid","kind":"json-schema","title":"ocsfv1.8.0trainingcampaigninventoryinfoClassUid","data":{"title":"ocsfv1.8.0trainingcampaigninventoryinfoClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n98905002 - TrainingCampaignInventoryInfo: Training Campaign Inventory Info events report security awareness training campaign inventory from security awareness training products. These events describe training campaigns, assignments, or learning program instances that are either logged or proactively collected."}},"components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoSeverityId":{"id":"components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoSeverityId","kind":"json-schema","title":"ocsfv1.8.0trainingcampaigninventoryinfoSeverityId","data":{"title":"ocsfv1.8.0trainingcampaigninventoryinfoSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoStatusId":{"id":"components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoStatusId","kind":"json-schema","title":"ocsfv1.8.0trainingcampaigninventoryinfoStatusId","data":{"title":"ocsfv1.8.0trainingcampaigninventoryinfoStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoTrainingCampaignInventoryInfo":{"id":"components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoTrainingCampaignInventoryInfo","kind":"json-schema","title":"ocsfv1.8.0trainingcampaigninventoryinfoTrainingCampaignInventoryInfo","data":{"title":"ocsfv1.8.0trainingcampaigninventoryinfoTrainingCampaignInventoryInfo","type":"object","description":"Training Campaign Inventory Info events report security awareness training campaign inventory from security awareness training products. These events describe training campaigns, assignments, or learning program instances that are either logged or proactively collected.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the training campaign's creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the training campaign's creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"training_campaign":{"$ref":"#/components/schemas/ocsfv1.8.0TrainingCampaign","description":"The security awareness training campaign that was discovered."},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","training_campaign","type_uid"]}},"components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoTypeUid":{"id":"components/schemas/ocsfv1.8.0trainingcampaigninventoryinfoTypeUid","kind":"json-schema","title":"ocsfv1.8.0trainingcampaigninventoryinfoTypeUid","data":{"title":"ocsfv1.8.0trainingcampaigninventoryinfoTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n9890500200 - Unknown\n9890500201 - Log: The discovered information is via a log.\n9890500202 - Collect: The discovered information is via a collection process.\n9890500299 - Other"}},"components/schemas/ocsfv1.8.0userinventoryActivityId":{"id":"components/schemas/ocsfv1.8.0userinventoryActivityId","kind":"json-schema","title":"ocsfv1.8.0userinventoryActivityId","data":{"title":"ocsfv1.8.0userinventoryActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Log: The discovered information is via a log."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Collect: The discovered information is via a collection process."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0userinventoryCategoryUid":{"id":"components/schemas/ocsfv1.8.0userinventoryCategoryUid","kind":"json-schema","title":"ocsfv1.8.0userinventoryCategoryUid","data":{"title":"ocsfv1.8.0userinventoryCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects."}},"components/schemas/ocsfv1.8.0userinventoryClassUid":{"id":"components/schemas/ocsfv1.8.0userinventoryClassUid","kind":"json-schema","title":"ocsfv1.8.0userinventoryClassUid","data":{"title":"ocsfv1.8.0userinventoryClassUid","type":"integer","description":"ClassUid is an enum, and the following values are allowed.\n5003 - UserInventoryInfo: User Inventory Info events report user inventory data that is either logged or proactively collected. For example, when collecting user information from Active Directory entries."}},"components/schemas/ocsfv1.8.0userinventorySeverityId":{"id":"components/schemas/ocsfv1.8.0userinventorySeverityId","kind":"json-schema","title":"ocsfv1.8.0userinventorySeverityId","data":{"title":"ocsfv1.8.0userinventorySeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0userinventoryStatusId":{"id":"components/schemas/ocsfv1.8.0userinventoryStatusId","kind":"json-schema","title":"ocsfv1.8.0userinventoryStatusId","data":{"title":"ocsfv1.8.0userinventoryStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Success"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Failure"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0userinventoryTypeUid":{"id":"components/schemas/ocsfv1.8.0userinventoryTypeUid","kind":"json-schema","title":"ocsfv1.8.0userinventoryTypeUid","data":{"title":"ocsfv1.8.0userinventoryTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n500300 - Unknown\n500301 - Log: The discovered information is via a log.\n500302 - Collect: The discovered information is via a collection process.\n500399 - Other"}},"components/schemas/ocsfv1.8.0userinventoryUserInventory":{"id":"components/schemas/ocsfv1.8.0userinventoryUserInventory","kind":"json-schema","title":"ocsfv1.8.0userinventoryUserInventory","data":{"title":"ocsfv1.8.0userinventoryUserInventory","type":"object","description":"User Inventory Info events report user inventory data that is either logged or proactively collected. For example, when collecting user information from Active Directory entries.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0userinventoryActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.8.0Actor","nullable":true,"description":"The actor describes the process that was the source of the inventory activity. In the case of user inventory data, that could be a particular process or script that is run to scrape the user data. For example, it could be a powershell process that runs to pull data from the Azure AD graph API."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0userinventoryCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0userinventoryClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0userinventorySeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0userinventoryStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0userinventoryTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"user":{"$ref":"#/components/schemas/ocsfv1.8.0User","description":"The user that is being discovered by an inventory process."}},"required":["activity_id","category_uid","class_uid","metadata","severity_id","time","type_uid","user"]}},"components/schemas/ocsfv1.8.0vulnerabilityfindingActionId":{"id":"components/schemas/ocsfv1.8.0vulnerabilityfindingActionId","kind":"json-schema","title":"ocsfv1.8.0vulnerabilityfindingActionId","data":{"title":"ocsfv1.8.0vulnerabilityfindingActionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The action was unknown. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute may still be set to a non-unknown value, for example 'Custom Action', 'Challenge'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: The activity was allowed. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Denied: The attempted activity was denied. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Observed: The activity was observed, but neither explicitly allowed nor denied. This is common with IDS and EDR controls that report additional information on observed behavior such as TTPs. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set to a value that conforms to this action, for example 'Logged', 'Alert', 'Detected', 'Count', etc."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Modified: The activity was modified, adjusted, or corrected. The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute should be set appropriately, for example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The action is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0vulnerabilityfindingActivityId":{"id":"components/schemas/ocsfv1.8.0vulnerabilityfindingActivityId","kind":"json-schema","title":"ocsfv1.8.0vulnerabilityfindingActivityId","data":{"title":"ocsfv1.8.0vulnerabilityfindingActivityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ActivityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event activity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Create: A finding was created."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Update: A finding was updated."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Close: A finding was closed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event activity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_name"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0vulnerabilityfindingCategoryUid":{"id":"components/schemas/ocsfv1.8.0vulnerabilityfindingCategoryUid","kind":"json-schema","title":"ocsfv1.8.0vulnerabilityfindingCategoryUid","data":{"title":"ocsfv1.8.0vulnerabilityfindingCategoryUid","type":"integer","description":"CategoryUid is an enum, and the following values are allowed.\n2 - Findings: Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products."}},"components/schemas/ocsfv1.8.0vulnerabilityfindingClassUid":{"id":"components/schemas/ocsfv1.8.0vulnerabilityfindingClassUid","kind":"json-schema","title":"ocsfv1.8.0vulnerabilityfindingClassUid","data":{"title":"ocsfv1.8.0vulnerabilityfindingClassUid","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ClassUid is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2002 - VulnerabilityFinding: The Vulnerability Finding event is a notification about weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source. Note: if the event producer is a security control, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile should be applied and its "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"attacks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" information, if present, should be duplicated into the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note: "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the Finding is an incident, i.e. requires incident workflow, also apply the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"incident"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile  or aggregate this finding into an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Incident Finding"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0vulnerabilityfindingConfidenceId":{"id":"components/schemas/ocsfv1.8.0vulnerabilityfindingConfidenceId","kind":"json-schema","title":"ocsfv1.8.0vulnerabilityfindingConfidenceId","data":{"title":"ocsfv1.8.0vulnerabilityfindingConfidenceId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ConfidenceId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The normalized confidence is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The confidence is not mapped to the defined enum values. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"confidence"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0vulnerabilityfindingDispositionId":{"id":"components/schemas/ocsfv1.8.0vulnerabilityfindingDispositionId","kind":"json-schema","title":"ocsfv1.8.0vulnerabilityfindingDispositionId","data":{"title":"ocsfv1.8.0vulnerabilityfindingDispositionId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"DispositionId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The disposition is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Allowed: Granted access or allowed the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Blocked: Denied access or blocked the action to the protected resource."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Quarantined: A suspicious file or other content was moved to a benign location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Isolated: A session was isolated on the network or within a browser."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Deleted: A file or other content was deleted."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Dropped: The request was detected as a threat and resulted in the connection being dropped."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"7 - CustomAction: A custom action was executed such as running of a command script. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Allowed'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"9 - Restored: A quarantined file or other content was restored to its original location."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"11 - Corrected: A corrupt file or configuration was corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"12 - PartiallyCorrected: A corrupt file or configuration was partially corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"13 - Uncorrected: A corrupt file or configuration was not corrected."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"15 - Detected: Suspicious activity or a policy violation was detected without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"16 - NoAction: The outcome of an operation had no action taken."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"17 - Logged: The operation or action was logged without further action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"18 - Tagged: A file or other entity was marked with extended attributes."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"20 - Count: Counted the request or activity but did not determine whether to allow it or block it."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"21 - Reset: The request was detected as a threat and resulted in the connection being reset."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Host"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile if the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"User"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Actor"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" requestor is not present in the event class."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"25 - Rejected: A request or submission was rejected.  For example, when a form was improperly filled out and submitted. This is distinct from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked'."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"2"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" 'Blocked' and can be complemented with the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"authorizations"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute for more detail."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"27 - Error: An error occurred during the processing of the activity or request. Use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute of the base class for details."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The disposition is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0vulnerabilityfindingRiskLevelId":{"id":"components/schemas/ocsfv1.8.0vulnerabilityfindingRiskLevelId","kind":"json-schema","title":"ocsfv1.8.0vulnerabilityfindingRiskLevelId","data":{"title":"ocsfv1.8.0vulnerabilityfindingRiskLevelId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"RiskLevelId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Info"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Low"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Medium"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - High"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Critical"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The risk level is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0vulnerabilityfindingSeverityId":{"id":"components/schemas/ocsfv1.8.0vulnerabilityfindingSeverityId","kind":"json-schema","title":"ocsfv1.8.0vulnerabilityfindingSeverityId","data":{"title":"ocsfv1.8.0vulnerabilityfindingSeverityId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"SeverityId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The event/finding severity is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - Informational: Informational message. No action required."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - Low: The user decides if action is needed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Medium: Action is required but the situation is not serious at this time."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - High: Action is required immediately."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Critical: Action is required immediately and the scope is broad."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Fatal: An error occurred but it is too late to take remedial action."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The event/finding severity is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0vulnerabilityfindingStatusId":{"id":"components/schemas/ocsfv1.8.0vulnerabilityfindingStatusId","kind":"json-schema","title":"ocsfv1.8.0vulnerabilityfindingStatusId","data":{"title":"ocsfv1.8.0vulnerabilityfindingStatusId","type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"StatusId is an enum, and the following values are allowed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"0 - Unknown: The status is unknown."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1 - New: The Finding is new and yet to be reviewed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"2 - InProgress: The Finding is under review."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"3 - Suppressed: The Finding was reviewed, determined to be benign or a false positive and is now suppressed."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"4 - Resolved: The Finding was reviewed, remediated and is now considered resolved."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"5 - Archived: The Finding was archived."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"6 - Deleted: The Finding was deleted. For example, it might have been created in error."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{},"children":[],"type":"softbreak"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"99 - Other: The status is not mapped. See the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"status"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" attribute, which contains a data source specific value."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/ocsfv1.8.0vulnerabilityfindingTypeUid":{"id":"components/schemas/ocsfv1.8.0vulnerabilityfindingTypeUid","kind":"json-schema","title":"ocsfv1.8.0vulnerabilityfindingTypeUid","data":{"title":"ocsfv1.8.0vulnerabilityfindingTypeUid","type":"integer","description":"TypeUid is an enum, and the following values are allowed.\n200200 - Unknown\n200201 - Create: A finding was created.\n200202 - Update: A finding was updated.\n200203 - Close: A finding was closed.\n200299 - Other"}},"components/schemas/ocsfv1.8.0vulnerabilityfindingVulnerabilityFinding":{"id":"components/schemas/ocsfv1.8.0vulnerabilityfindingVulnerabilityFinding","kind":"json-schema","title":"ocsfv1.8.0vulnerabilityfindingVulnerabilityFinding","data":{"title":"ocsfv1.8.0vulnerabilityfindingVulnerabilityFinding","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Vulnerability Finding event is a notification about weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source. Note: if the event producer is a security control, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile should be applied and its "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"attacks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" information, if present, should be duplicated into the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note: "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the Finding is an incident, i.e. requires incident workflow, also apply the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"incident"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile  or aggregate this finding into an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Incident Finding"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingActivityId","description":"The normalized identifier of the finding activity."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The finding activity name, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"comment":{"type":"string","nullable":true,"description":"A user provided comment about the finding."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"device":{"$ref":"#/components/schemas/ocsfv1.8.0Device","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the affected device/host. If applicable, it can be used in conjunction with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Resource(s)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. Specific details about an AWS EC2 instance, that is affected by the Finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the most recent event included in the finding."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the most recent event included in the finding."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"finding_info":{"$ref":"#/components/schemas/ocsfv1.8.0FindingInfo","description":"Describes the supporting information about a generated finding."},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"resource":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails","nullable":true,"description":"Describes details about the resource that is affected by the vulnerability/vulnerabilities."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails"},"nullable":true,"description":"Describes details about the resource/resources that are affected by the vulnerability/vulnerabilities."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the least recent event included in the finding."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the least recent event included in the finding."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingStatusId","nullable":true,"description":"The normalized status identifier of the Finding, set by the consumer."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"vendor_attributes":{"$ref":"#/components/schemas/ocsfv1.8.0VendorAttributes","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability."},"children":[],"type":"text"}],"type":"paragraph"}]},"vulnerabilities":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Vulnerability"},"description":"This object describes vulnerabilities reported in a security finding."}},"required":["activity_id","category_uid","class_uid","finding_info","metadata","severity_id","time","type_uid","vulnerabilities"]}},"components/schemas/AsyncOperationRequestId":{"id":"components/schemas/AsyncOperationRequestId","kind":"json-schema","title":"Id","data":{"title":"Id","type":"string"}},"components/schemas/OperationInput":{"id":"components/schemas/OperationInput","kind":"json-schema","title":"OperationInput","data":{"title":"OperationInput","type":"object","properties":{"filters":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Limit the number of results returned by the operation. If not specified, the operation will return all results."},"limit":{"type":"integer","nullable":true,"description":"Limit query results by these filters."}}}},"components/schemas/Operation":{"id":"components/schemas/Operation","kind":"json-schema","title":"Operation","data":{"title":"Operation","type":"object","properties":{"id":{"$ref":"#/components/schemas/AsyncOperationRequestId","description":"ID of the operation"},"created_at":{"type":"string","format":"date-time","description":"Time object was originally created"},"updated_at":{"type":"string","format":"date-time","description":"Last time object was updated"},"account_id":{"$ref":"#/components/schemas/Id","description":"Account ID containing the integration."},"integration_id":{"$ref":"#/components/schemas/Id","description":"Integration ID to use for the operation."},"operation":{"type":"string","description":"Name of the operation that will be run for this operation."},"input":{"$ref":"#/components/schemas/OperationInput","description":"Parameters for the operation that will be run for this operation."},"status":{"$ref":"#/components/schemas/OperationStatus","description":"Status of the operation"},"errors":{"type":"array","items":{"$ref":"#/components/schemas/OperationError"},"nullable":true,"description":"Errors that occurred during the operation"},"cpu_time":{"type":"integer","format":"int64","description":"Cpu time in microseconds"},"in_bytes":{"type":"integer","format":"int64","description":"Total number of bytes sent to the output integration."},"output_integration_id":{"type":"string","nullable":true,"description":"ID of the integration receiving operation output."}},"required":["id","created_at","updated_at","account_id","integration_id","operation","input","status","cpu_time","in_bytes"]}},"components/schemas/OperationStatus":{"id":"components/schemas/OperationStatus","kind":"json-schema","title":"OperationStatus","data":{"title":"OperationStatus","type":"string","enum":["SCHEDULED","PROCESSING","CANCELLED","COMPLETE","DISABLED"]}},"components/schemas/OperationError":{"id":"components/schemas/OperationError","kind":"json-schema","title":"OperationError","data":{"title":"OperationError","type":"object","properties":{"message":{"type":"string","description":"Error message"}},"required":["message"]}},"components/schemas/CreateOperationRequest":{"id":"components/schemas/CreateOperationRequest","kind":"json-schema","title":"CreateOperationRequest","data":{"title":"CreateOperationRequest","type":"object","properties":{"operation":{"type":"string","description":"Name of the operation that will be run for this operation."},"input":{"$ref":"#/components/schemas/OperationInput","description":"Input parameters to the operation that will be run for this operation."}},"required":["operation","input"]}},"components/schemas/CreateOperationResponseResult":{"id":"components/schemas/CreateOperationResponseResult","kind":"json-schema","title":"CreateOperationResponseResult","data":{"title":"CreateOperationResponseResult","type":"object","properties":{"operation":{"$ref":"#/components/schemas/Operation"}},"required":["operation"]}},"components/schemas/CreateOperationResponse":{"id":"components/schemas/CreateOperationResponse","kind":"json-schema","title":"CreateOperationResponse","data":{"title":"CreateOperationResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/CreateOperationResponseResult"}},"required":["result"]}},"components/schemas/GetOperationResponse":{"id":"components/schemas/GetOperationResponse","kind":"json-schema","title":"GetOperationResponse","data":{"title":"GetOperationResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/Operation"}},"required":["result"]}},"components/schemas/SecurityAwarenessQueryTrainingCampaignsResponse":{"id":"components/schemas/SecurityAwarenessQueryTrainingCampaignsResponse","kind":"json-schema","title":"SecurityAwarenessQueryTrainingCampaignsResponse","data":{"title":"SecurityAwarenessQueryTrainingCampaignsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsflatestTrainingCampaignInventoryInfo"},"description":"List of training campaigns that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/SecurityAwarenessQueryPhishingSimulationsResponse":{"id":"components/schemas/SecurityAwarenessQueryPhishingSimulationsResponse","kind":"json-schema","title":"SecurityAwarenessQueryPhishingSimulationsResponse","data":{"title":"SecurityAwarenessQueryPhishingSimulationsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsflatestPhishingSimulationInventoryInfo"},"description":"List of phishing simulations that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/SecurityAwarenessQueryUsersResponse":{"id":"components/schemas/SecurityAwarenessQueryUsersResponse","kind":"json-schema","title":"SecurityAwarenessQueryUsersResponse","data":{"title":"SecurityAwarenessQueryUsersResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsflatestUserInventoryInfo"},"description":"List of users that match the query."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/SecurityAwarenessGetTrainingCampaignDetailsResponse":{"id":"components/schemas/SecurityAwarenessGetTrainingCampaignDetailsResponse","kind":"json-schema","title":"SecurityAwarenessGetTrainingCampaignDetailsResponse","data":{"title":"SecurityAwarenessGetTrainingCampaignDetailsResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/ocsflatestTrainingCampaignInventoryInfo","description":"The details of the training campaign."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/SecurityAwarenessGetPhishingSimulationDetailsResponse":{"id":"components/schemas/SecurityAwarenessGetPhishingSimulationDetailsResponse","kind":"json-schema","title":"SecurityAwarenessGetPhishingSimulationDetailsResponse","data":{"title":"SecurityAwarenessGetPhishingSimulationDetailsResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/ocsflatestPhishingSimulationInventoryInfo","description":"The details of the phishing simulation."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/SecurityAwarenessGetUserDetailsResponse":{"id":"components/schemas/SecurityAwarenessGetUserDetailsResponse","kind":"json-schema","title":"SecurityAwarenessGetUserDetailsResponse","data":{"title":"SecurityAwarenessGetUserDetailsResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/ocsflatestUserInventoryInfo","description":"The details of the user."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/CreateSiemEventsResponse":{"id":"components/schemas/CreateSiemEventsResponse","kind":"json-schema","title":"CreateSiemEventsResponse","data":{"title":"CreateSiemEventsResponse","type":"object","properties":{"result":{"type":"array","items":{"type":"object","additionalProperties":true},"description":"List of events written if available. Most providers do not return events, just a success status. Review messages for any failure details available."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/QuerySiemEventsResponse":{"id":"components/schemas/QuerySiemEventsResponse","kind":"json-schema","title":"QuerySiemEventsResponse","data":{"title":"QuerySiemEventsResponse","type":"object","properties":{"result":{"type":"array","items":{"type":"object","additionalProperties":true},"description":"List of events"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"},{"$ref":"#/components/schemas/APIHasStatus"}]}},"components/schemas/QueryInvestigationResponse":{"id":"components/schemas/QueryInvestigationResponse","kind":"json-schema","title":"QueryInvestigationResponse","data":{"title":"QueryInvestigationResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/Investigation"},"description":"List of investigations"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/QuerySiemAlertsResponse":{"id":"components/schemas/QuerySiemAlertsResponse","kind":"json-schema","title":"QuerySiemAlertsResponse","data":{"title":"QuerySiemAlertsResponse","type":"object","properties":{"result":{"type":"array","items":{"type":"object","additionalProperties":true},"description":"List of alerts"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/GetAlertResponse":{"id":"components/schemas/GetAlertResponse","kind":"json-schema","title":"GetAlertResponse","data":{"title":"GetAlertResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/ocsfv1.3.0detectionfindingDetectionFinding","description":"The mapped alert"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/PatchInvestigationRequest":{"id":"components/schemas/PatchInvestigationRequest","kind":"json-schema","title":"PatchInvestigationRequest","data":{"title":"PatchInvestigationRequest","type":"array","items":{"$ref":"#/components/schemas/PatchOperation"},"description":"JSON patch to apply to an investigation."}},"components/schemas/Investigation":{"id":"components/schemas/Investigation","kind":"json-schema","title":"Investigation","data":{"title":"Investigation","type":"object","properties":{"id":{"type":"string","description":"Unique identifier for the investigation"},"custom_fields":{"type":"object","additionalProperties":true,"nullable":true,"description":"Custom mapped fields from the investigation"},"raw_data":{"type":"string","description":"Original response from the SIEM"}},"required":["id","raw_data"]}},"components/schemas/Evidence":{"id":"components/schemas/Evidence","kind":"json-schema","title":"Evidence","data":{"title":"Evidence","type":"object","properties":{"investigation_id":{"type":"string","description":"Unique identifier for the investigation associated with the evidence"},"raw_data":{"type":"string","description":"Original response from the SIEM"}},"required":["investigation_id","raw_data"]}},"components/schemas/GetInvestigationResponse":{"id":"components/schemas/GetInvestigationResponse","kind":"json-schema","title":"GetInvestigationResponse","data":{"title":"GetInvestigationResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/Investigation","description":"The investigation object"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/GetEvidenceResponse":{"id":"components/schemas/GetEvidenceResponse","kind":"json-schema","title":"GetEvidenceResponse","data":{"title":"GetEvidenceResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/Evidence","description":"List of evidence associated with an investigation"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/LogProvider":{"id":"components/schemas/LogProvider","kind":"json-schema","title":"LogProvider","data":{"title":"LogProvider","type":"object","properties":{"source":{"type":"string","nullable":true,"description":"Some backing providers have multiple log source types. When available, this metadata provides an indication of the backing provider' log provider type."},"name":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Name of the log provider, usable as a filter value for metadata.log_provider when querying for events."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["name"]}},"components/schemas/QueryLogProvidersResponse":{"id":"components/schemas/QueryLogProvidersResponse","kind":"json-schema","title":"QueryLogProvidersResponse","data":{"title":"QueryLogProvidersResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/LogProvider"},"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"List of available metadata.log_provider values available for querying events"},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"},{"$ref":"#/components/schemas/APIHasStatus"}]}},"components/schemas/CreateSinkEventsResponse":{"id":"components/schemas/CreateSinkEventsResponse","kind":"json-schema","title":"CreateSinkEventsResponse","data":{"title":"CreateSinkEventsResponse","type":"object","properties":{"result":{"type":"array","items":{"type":"object","additionalProperties":true},"description":"List of events written if available. Most providers do not return events, just a success status. Review messages for any failure details available."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/SsfEventResult":{"id":"components/schemas/SsfEventResult","kind":"json-schema","title":"SsfEventResult","data":{"title":"SsfEventResult","type":"object","properties":{"event_id":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Synqly-assigned identifier for this signal. Synqly uses the same value as the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"jti"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" claim of the token it delivered, so it correlates a Synqly request with a receiver-side record of the token."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["event_id"],"x-fern-availability":"in-development"}},"components/schemas/CreateSsfEventResponse":{"id":"components/schemas/CreateSsfEventResponse","kind":"json-schema","title":"CreateSsfEventResponse","data":{"title":"CreateSsfEventResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/SsfEventResult"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}],"x-fern-availability":"in-development"}},"components/schemas/SsfTransmitterUrls":{"id":"components/schemas/SsfTransmitterUrls","kind":"json-schema","title":"SsfTransmitterUrls","data":{"title":"SsfTransmitterUrls","type":"object","properties":{"issuer":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Issuer URL to register with the receiver. It matches the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"iss"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" claim of every token Synqly signs for this integration."},"children":[],"type":"text"}],"type":"paragraph"}]},"jwks_url":{"type":"string","description":"JWKS URL to register with the receiver. It serves the public half of this integration's signing keys, without authentication, and must be reachable from the receiver over the public internet."},"well_known_url":{"type":"string","description":"Discovery URL for receivers that support it. It serves this integration's Transmitter Configuration Metadata, which names the Issuer URL and the JWKS URL, so a receiver that accepts a well-known URL needs only this one value instead of the other two."}},"required":["issuer","jwks_url","well_known_url"],"x-fern-availability":"in-development"}},"components/schemas/GetSsfTransmitterUrlsResponse":{"id":"components/schemas/GetSsfTransmitterUrlsResponse","kind":"json-schema","title":"GetSsfTransmitterUrlsResponse","data":{"title":"GetSsfTransmitterUrlsResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/SsfTransmitterUrls"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}],"x-fern-availability":"in-development"}},"components/schemas/stixId":{"id":"components/schemas/stixId","kind":"json-schema","title":"stixId","data":{"title":"stixId","type":"string"}},"components/schemas/stixExternalReference":{"id":"components/schemas/stixExternalReference","kind":"json-schema","title":"stixExternalReference","data":{"title":"stixExternalReference","type":"object","properties":{"source_name":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The source_name property specifies the name of the source that provided the external reference."},"children":[],"type":"text"}],"type":"paragraph"}]},"description":{"type":"string","nullable":true,"description":"The description property provides a human-readable explanation of the external reference."},"url":{"type":"string","nullable":true,"description":"The url property specifies the URL of the external reference."},"hash":{"type":"string","nullable":true,"description":"The hash property specifies a hash value that uniquely identifies the external reference."},"external_id":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The external_id property specifies an identifier used by the source of the external reference."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["source_name"]}},"components/schemas/stixGranularMarking":{"id":"components/schemas/stixGranularMarking","kind":"json-schema","title":"stixGranularMarking","data":{"title":"stixGranularMarking","type":"object","properties":{"lang":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The lang property specifies the language used in the properties of the marking_definition object."},"children":[],"type":"text"}],"type":"paragraph"}]},"marking_ref":{"$ref":"#/components/schemas/stixMarkingDefinition","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The marking_ref property specifies the id property of the marking_definition object that applies to this object."},"children":[],"type":"text"}],"type":"paragraph"}]},"selectors":{"type":"array","items":{"type":"string"},"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The selectors property is an array of strings that represent the selectors that are used to apply the marking_definition object to this object."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["selectors"]}},"components/schemas/stixKillChainPhase":{"id":"components/schemas/stixKillChainPhase","kind":"json-schema","title":"stixKillChainPhase","data":{"title":"stixKillChainPhase","type":"object","properties":{"kill_chain_name":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The kill_chain_name property specifies the name of the kill chain to which the phase belongs."},"children":[],"type":"text"}],"type":"paragraph"}]},"phase_name":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The phase_name property specifies the name of the phase within the kill chain."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["kill_chain_name","phase_name"]}},"components/schemas/stixCommonProperties":{"id":"components/schemas/stixCommonProperties","kind":"json-schema","title":"stixCommonProperties","data":{"title":"stixCommonProperties","type":"object","properties":{"spec_version":{"type":"string","const":"2.1"},"id":{"$ref":"#/components/schemas/stixId","description":"The id property uniquely identifies this object."},"created_by_ref":{"$ref":"#/components/schemas/stixIdentity","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The created_by_ref property specifies the id property of the identity object that describes the entity that created this object."},"children":[],"type":"text"}],"type":"paragraph"}]},"created":{"type":"string","format":"date-time","description":"The created property represents the time at which the object was originally created."},"modified":{"type":"string","format":"date-time","description":"The modified property is only used by STIX Objects that support versioning and represents the time that this particular version of the object was last modified."},"revoked":{"type":"boolean","nullable":true,"description":"The revoked property indicates whether this object has been revoked. If the revoked property is present and set to true, then the object has been revoked."},"labels":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The labels property is an array of strings that are used to categorize this object."},"confidence":{"type":"integer","nullable":true,"description":"The confidence property is an integer from 0 to 100 that represents the confidence that this object is accurate and valid."},"lang":{"type":"string","nullable":true,"description":"The lang property specifies the language used in the properties of the object."},"external_references":{"type":"array","items":{"$ref":"#/components/schemas/stixExternalReference"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The external_references property is an array of external references that are relevant to this object."},"children":[],"type":"text"}],"type":"paragraph"}]},"object_marking_refs":{"type":"array","items":{"$ref":"#/components/schemas/stixMarkingDefinition"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The object_marking_refs property is an array of ids of marking_definition objects that apply to this object."},"children":[],"type":"text"}],"type":"paragraph"}]},"granular_markings":{"type":"array","items":{"$ref":"#/components/schemas/stixGranularMarking"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The granular_markings property is an array of granular markings that are applied to this object."},"children":[],"type":"text"}],"type":"paragraph"}]},"extensions":{"type":"object","additionalProperties":true,"nullable":true,"description":"The extensions property is an object that contains custom properties or objects that extend the object."}},"required":["spec_version","id","created","modified"]}},"components/schemas/stixMarkingDefinition":{"id":"components/schemas/stixMarkingDefinition","kind":"json-schema","title":"stixMarkingDefinition","data":{"title":"stixMarkingDefinition","type":"object","properties":{"type":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The type property identifies the type of object. The value of this property MUST be marking_definition."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","nullable":true}},"required":["type"]}},"components/schemas/stixIdentity":{"id":"components/schemas/stixIdentity","kind":"json-schema","title":"stixIdentity","data":{"title":"stixIdentity","type":"object","properties":{"type":{"type":"string","description":"The value of this property MUST be identity."},"name":{"type":"string","description":"The name of this Identity. When referring to a specific entity (e.g., an individual or organization), this property SHOULD contain the canonical name of the specific entity."},"description":{"type":"string","nullable":true},"roles":{"type":"string","nullable":true,"description":"The list of roles that this Identity performs. No open vocabulary is yet defined for this property."},"identity_class":{"$ref":"#/components/schemas/stixidentity_class_ov","nullable":true}},"required":["type","name"],"allOf":[{"$ref":"#/components/schemas/stixCommonProperties"}]}},"components/schemas/stixIndicator":{"id":"components/schemas/stixIndicator","kind":"json-schema","title":"stixIndicator","data":{"title":"stixIndicator","type":"object","properties":{"type":{"type":"string","const":"indicator"},"name":{"type":"string","nullable":true,"description":"A name used to identify the Indicator."},"description":{"type":"string","nullable":true,"description":"A description that provides more details and context about the Indicator, potentially including its purpose and its key characteristics."},"indicator_types":{"type":"array","items":{"$ref":"#/components/schemas/stixindicator_type_ov"},"nullable":true,"description":"A set of categorizations for this indicator."},"pattern":{"type":"string","nullable":true,"description":"The detection pattern for this Indicator MAY be expressed as a STIX Pattern as specified in section 9 or another appropriate language such as SNORT, YARA, etc."},"pattern_type":{"$ref":"#/components/schemas/stixpattern_type_ov","nullable":true,"description":"The type of pattern expression used in the pattern property."},"pattern_version":{"type":"string","nullable":true,"description":"The version of the pattern expression used in the pattern property."},"valid_from":{"type":"string","format":"date-time","description":"The time from which this Indicator is considered a valid indicator of the behaviors it is related or represents."},"valid_until":{"type":"string","format":"date-time","nullable":true,"description":"The time at which this Indicator is no longer considered valid."},"kill_chain_phases":{"type":"array","items":{"$ref":"#/components/schemas/stixKillChainPhase"},"nullable":true,"description":"The kill chain phase to which this Indicator corresponds."},"raw_data":{"type":"string","nullable":true,"description":"The data as received from the source."}},"required":["type","valid_from"],"allOf":[{"$ref":"#/components/schemas/stixCommonProperties"}]}},"components/schemas/stixindicator_type_ov":{"id":"components/schemas/stixindicator_type_ov","kind":"json-schema","title":"stixindicator_type_ov","data":{"title":"stixindicator_type_ov","type":"string","enum":["anomalous_activity","anonymization","benign","compromised","malicious_activity","attribution","unknown"]}},"components/schemas/stixpattern_type_ov":{"id":"components/schemas/stixpattern_type_ov","kind":"json-schema","title":"stixpattern_type_ov","data":{"title":"stixpattern_type_ov","type":"string","enum":["stix","pcre","sigma","snort","suricata","yara"],"description":"covers common pattern languages"}},"components/schemas/stixidentity_class_ov":{"id":"components/schemas/stixidentity_class_ov","kind":"json-schema","title":"stixidentity_class_ov","data":{"title":"stixidentity_class_ov","type":"string","enum":["individual","group","system","organization","class","unknown"]}},"components/schemas/ListStorageResponse":{"id":"components/schemas/ListStorageResponse","kind":"json-schema","title":"ListStorageResponse","data":{"title":"ListStorageResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/StoragePath"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/StoragePath":{"id":"components/schemas/StoragePath","kind":"json-schema","title":"StoragePath","data":{"title":"StoragePath","type":"object","properties":{"path":{"type":"string"}},"required":["path"]}},"components/schemas/ThreatIntelLookupHashResponse":{"id":"components/schemas/ThreatIntelLookupHashResponse","kind":"json-schema","title":"ThreatIntelLookupHashResponse","data":{"title":"ThreatIntelLookupHashResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/ocsfv1.8.0osintinventoryinfoOsintInventoryInfo","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Normalized reputation and context for the queried file hash, as an OCSF OSINT Inventory Info event (class_uid 5021). Each intel record the provider returned is one entry in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"osint"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" array; a lookup that finds no records is a successful response with an empty array."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}],"x-fern-availability":"in-development"}},"components/schemas/ThreatIntelLookupUrlResponse":{"id":"components/schemas/ThreatIntelLookupUrlResponse","kind":"json-schema","title":"ThreatIntelLookupUrlResponse","data":{"title":"ThreatIntelLookupUrlResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/ocsfv1.8.0osintinventoryinfoOsintInventoryInfo","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Normalized reputation and context for the queried URL, as an OCSF OSINT Inventory Info event (class_uid 5021). Each intel record the provider returned is one entry in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"osint"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" array; a lookup that finds no records is a successful response with an empty array."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}],"x-fern-availability":"in-development"}},"components/schemas/ThreatIntelLookupDomainResponse":{"id":"components/schemas/ThreatIntelLookupDomainResponse","kind":"json-schema","title":"ThreatIntelLookupDomainResponse","data":{"title":"ThreatIntelLookupDomainResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/ocsfv1.8.0osintinventoryinfoOsintInventoryInfo","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Normalized reputation and context for the queried domain, as an OCSF OSINT Inventory Info event (class_uid 5021). Each intel record the provider returned is one entry in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"osint"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" array; a lookup that finds no records is a successful response with an empty array."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}],"x-fern-availability":"in-development"}},"components/schemas/ThreatIntelLookupIpResponse":{"id":"components/schemas/ThreatIntelLookupIpResponse","kind":"json-schema","title":"ThreatIntelLookupIpResponse","data":{"title":"ThreatIntelLookupIpResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/ocsfv1.8.0osintinventoryinfoOsintInventoryInfo","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Normalized reputation and context for the queried IP address, as an OCSF OSINT Inventory Info event (class_uid 5021). Each intel record the provider returned is one entry in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"osint"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" array; a lookup that finds no records is a successful response with an empty array."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}],"x-fern-availability":"in-development"}},"components/schemas/AttachmentId":{"id":"components/schemas/AttachmentId","kind":"json-schema","title":"Id","data":{"title":"Id","type":"string"}},"components/schemas/IssueTypeId":{"id":"components/schemas/IssueTypeId","kind":"json-schema","title":"IssueTypeId","data":{"title":"IssueTypeId","type":"string","description":"Unique identifier for an issue type"}},"components/schemas/ProjectId":{"id":"components/schemas/ProjectId","kind":"json-schema","title":"Id","data":{"title":"Id","type":"string"}},"components/schemas/TicketId":{"id":"components/schemas/TicketId","kind":"json-schema","title":"Id","data":{"title":"Id","type":"string"}},"components/schemas/CommentId":{"id":"components/schemas/CommentId","kind":"json-schema","title":"Id","data":{"title":"Id","type":"string"}},"components/schemas/Priority":{"id":"components/schemas/Priority","kind":"json-schema","title":"Priority","data":{"title":"Priority","type":"string","enum":["URGENT","CRITICAL","HIGH","MEDIUM","MODERATE","LOW","PLANNING"]}},"components/schemas/Status":{"id":"components/schemas/Status","kind":"json-schema","title":"Status","data":{"title":"Status","type":"string"}},"components/schemas/Ticket":{"id":"components/schemas/Ticket","kind":"json-schema","title":"Ticket","data":{"title":"Ticket","type":"object","description":"Ticketing ticket","properties":{"id":{"$ref":"#/components/schemas/TicketId"},"summary":{"type":"string","description":"Ticket summary."},"creator":{"type":"string","nullable":true,"description":"User who created this ticket."},"assignee":{"type":"string","nullable":true,"description":"Who ticket is assigned to."},"contact":{"type":"string","nullable":true,"description":"Ticket contact information."},"description":{"type":"string","nullable":true,"description":"Ticket description."},"priority":{"$ref":"#/components/schemas/Priority","nullable":true,"description":"The priority of the Ticket"},"due_date":{"type":"string","format":"date-time","nullable":true,"description":"The ticket's due date."},"completion_date":{"type":"string","format":"date-time","nullable":true,"description":"The ticket's complete date."},"status":{"$ref":"#/components/schemas/Status","nullable":true,"description":"The current status of the ticket."},"project":{"$ref":"#/components/schemas/ProjectId","nullable":true,"description":"The ticket project."},"issue_type":{"$ref":"#/components/schemas/IssueTypeId","nullable":true,"description":"The ticket's type."},"parent":{"$ref":"#/components/schemas/TicketId","nullable":true,"description":"Provider specific ID of the parent ticket."},"tags":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Associate tags with Ticket"},"attachments":{"type":"array","items":{"$ref":"#/components/schemas/AttachmentMetadata"},"nullable":true,"description":"Metadata of attachments associated with the ticket"},"custom_fields":{"type":"object","additionalProperties":true,"nullable":true,"description":"Custom fields for this ticket, keys are the custom field names."},"unmapped":{"$ref":"#/components/schemas/Object","nullable":true,"description":"The attributes that are not mapped to the ticket schema. The names and values of those attributes are specific to the provider."}},"required":["id","summary"],"allOf":[{"$ref":"#/components/schemas/Base"}]}},"components/schemas/Project":{"id":"components/schemas/Project","kind":"json-schema","title":"Project","data":{"title":"Project","type":"object","description":"Project in a ticketing system","properties":{"id":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Unique identifier for this project. Use this id in the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"project"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" field of a "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Ticket"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"name":{"type":"string","description":"Name of the project"},"custom_fields":{"type":"object","additionalProperties":true,"nullable":true,"description":"Custom mapped fields for this project."},"unmapped":{"$ref":"#/components/schemas/Object","nullable":true,"description":"The attributes that are not mapped to the project schema. The names and values of those attributes are specific to the provider."}},"required":["id","name"]}},"components/schemas/IssueType":{"id":"components/schemas/IssueType","kind":"json-schema","title":"IssueType","data":{"title":"IssueType","type":"object","description":"Issue type available on a Project in a ticketing system","properties":{"id":{"type":"string","description":"Unique identifier for this issue type."},"name":{"type":"string","description":"Name of the issue type."},"project_id":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"id"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the Project this issue type belongs to."},"children":[],"type":"text"}],"type":"paragraph"}]},"description":{"type":"string","nullable":true,"description":"Description of the issue type."},"unmapped":{"$ref":"#/components/schemas/Object","nullable":true,"description":"The attributes that are not mapped to the issue type schema. The names and values of those attributes are specific to the provider."}},"required":["id","name","project_id"],"x-fern-availability":"in-development"}},"components/schemas/Attachment":{"id":"components/schemas/Attachment","kind":"json-schema","title":"Attachment","data":{"title":"Attachment","type":"object","properties":{"file_name":{"type":"string","description":"The name of the file."},"file_type":{"type":"string","description":"The type of the file."},"content":{"type":"string","format":"byte","description":"File contents"},"unmapped":{"$ref":"#/components/schemas/Object","nullable":true,"description":"The attributes that are not mapped to the attachment schema. The names and values of those attributes are specific to the provider."}},"required":["file_name","file_type","content"]}},"components/schemas/AttachmentMetadata":{"id":"components/schemas/AttachmentMetadata","kind":"json-schema","title":"AttachmentMetadata","data":{"title":"AttachmentMetadata","type":"object","description":"Attachment in a ticketing system","properties":{"id":{"$ref":"#/components/schemas/AttachmentId","description":"Unique identifier for this attachment."},"ticket_id":{"$ref":"#/components/schemas/TicketId","description":"The ticket this attachment is associated with."},"file_name":{"type":"string","description":"The name of the file."},"file_type":{"type":"string","description":"The type of the file."},"file_size":{"type":"integer","nullable":true,"description":"The size of the file in bytes."},"created_date":{"type":"string","format":"date-time","description":"The date the attachment was created."},"creator":{"type":"string","description":"The user who created the attachment."},"unmapped":{"$ref":"#/components/schemas/Object","nullable":true,"description":"The attributes that are not mapped to the attachment metadata schema. The names and values of those attributes are specific to the provider."}},"required":["id","ticket_id","file_name","file_type","created_date","creator"]}},"components/schemas/RemoteField":{"id":"components/schemas/RemoteField","kind":"json-schema","title":"RemoteField","data":{"title":"RemoteField","type":"object","properties":{"field_id":{"type":"string","description":"Remote ID of the field."},"schema":{"$ref":"#/components/schemas/RemoteFieldSchema","nullable":true,"description":"Schema of the field."},"field_scope":{"$ref":"#/components/schemas/RemoteFieldScope","description":"Scope of remote field - standard or some kind of customization?"},"provider_field_name":{"type":"string","description":"Name of field in the remote ticketing provider."},"provider_field_path":{"type":"string","nullable":true,"description":"Path to the field in the remote ticketing provider. Uses dot notation for nested fields."},"project_id":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Project to which this field is scoped. On "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"list_remote_fields"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", set only on fields specific to one project. On "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"list_issue_type_remote_fields"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":", set on every field to the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"id"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the requested Project, as returned by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"list_projects"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"issue_type_id":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"id"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the issue type this field was listed for."},"children":[],"type":"text"}],"type":"paragraph"}],"x-fern-availability":"in-development"}},"required":["field_id","field_scope","provider_field_name"]}},"components/schemas/RemoteFieldSchema":{"id":"components/schemas/RemoteFieldSchema","kind":"json-schema","title":"RemoteFieldSchema","data":{"title":"RemoteFieldSchema","type":"object","properties":{"field_type_id":{"$ref":"#/components/schemas/RemoteFieldTypeId"},"field_Type":{"type":"string","nullable":true},"required":{"type":"boolean","nullable":true,"description":"Whether this field is required.","x-fern-availability":"in-development"},"enum_values":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Display names for possible values the enum can take on."},"enum_option_values":{"type":"array","items":{"$ref":"#/components/schemas/OptionValue"},"nullable":true,"description":"Possible values the enum can take on. For providers which don't distinguish between ID and display name, the ID and display name should be set to the same value."}},"required":["field_type_id"]}},"components/schemas/RemoteFieldTypeId":{"id":"components/schemas/RemoteFieldTypeId","kind":"json-schema","title":"RemoteFieldTypeId","data":{"title":"RemoteFieldTypeId","type":"string","enum":["string","number","enum","other"]}},"components/schemas/RemoteFieldScope":{"id":"components/schemas/RemoteFieldScope","kind":"json-schema","title":"RemoteFieldScope","data":{"title":"RemoteFieldScope","type":"string","enum":["standard","integration_custom","project_custom","ticket_custom","unknown"]}},"components/schemas/Comment":{"id":"components/schemas/Comment","kind":"json-schema","title":"Comment","data":{"title":"Comment","type":"object","description":"Comment on a ticket.","properties":{"id":{"$ref":"#/components/schemas/CommentId"},"ticket_id":{"$ref":"#/components/schemas/TicketId"},"creator":{"type":"string","description":"The user who created the comment."},"content":{"type":"string","description":"The content of the comment formatted as markdown."},"created_at":{"type":"string","format":"date-time","description":"The date the comment was created."},"updated_at":{"type":"string","format":"date-time","nullable":true,"description":"The date the comment was last updated."},"custom_fields":{"type":"object","additionalProperties":true,"nullable":true,"description":"Custom mapped fields for this project."},"unmapped":{"$ref":"#/components/schemas/Object","nullable":true,"description":"The attributes that are not mapped to the comment schema. The names and values of those attributes are specific to the provider."}},"required":["id","ticket_id","creator","content","created_at"]}},"components/schemas/Agent":{"id":"components/schemas/Agent","kind":"json-schema","title":"Agent","data":{"title":"Agent","type":"object","description":"An agent is a human that can be notified when certain conditions are met","properties":{"uid":{"$ref":"#/components/schemas/Id"},"full_name":{"type":"string"},"email_addr":{"type":"string","nullable":true},"phone_number":{"type":"string","nullable":true},"time_zone":{"type":"string","nullable":true},"job_title":{"type":"string","nullable":true},"unmapped":{"$ref":"#/components/schemas/Object","nullable":true,"description":"The attributes that are not mapped to the comment schema. The names and values of those attributes are specific to the provider."}},"required":["uid","full_name"],"x-fern-availability":"deprecated"}},"components/schemas/AgentSummary":{"id":"components/schemas/AgentSummary","kind":"json-schema","title":"AgentSummary","data":{"title":"AgentSummary","type":"object","description":"The agent summary object gives a summary of an agent in an escalation policy. An agent is a human that can be notified when certain conditions are met","properties":{"id":{"$ref":"#/components/schemas/Id","description":"Unique identifier for the agent."},"name":{"type":"string","description":"Name of the agent."},"additional_properties":{"type":"boolean","description":"Indicates if the agent has additional properties that can be retrieved."}},"required":["id","name","additional_properties"],"x-fern-availability":"deprecated"}},"components/schemas/GroupSummary":{"id":"components/schemas/GroupSummary","kind":"json-schema","title":"GroupSummary","data":{"title":"GroupSummary","type":"object","description":"The group summary object gives a summary of a group in an escalation policy. A group is a collection of agents that can be notified when certain conditions are met","properties":{"id":{"$ref":"#/components/schemas/Id","description":"Unique identifier for the group."},"name":{"type":"string","nullable":true,"description":"Name of the group."},"additional_properties":{"type":"boolean","description":"Indicates if the group has additional properties that can be retrieved."}},"required":["id","additional_properties"],"x-fern-availability":"deprecated"}},"components/schemas/ScheduleSummary":{"id":"components/schemas/ScheduleSummary","kind":"json-schema","title":"ScheduleSummary","data":{"title":"ScheduleSummary","type":"object","description":"The schedule summary object gives a summary of a schedule in an escalation policy. A schedule is a collection of agents that are notified at specific times","properties":{"id":{"$ref":"#/components/schemas/Id","description":"Unique identifier for the schedule."},"name":{"type":"string","nullable":true,"description":"Name of the schedule."},"additional_properties":{"type":"boolean","description":"Indicates if the schedule has additional properties that can be retrieved."}},"required":["id","additional_properties"],"x-fern-availability":"deprecated"}},"components/schemas/Actor":{"id":"components/schemas/Actor","kind":"json-schema","title":"Actor","data":{"title":"Actor","oneOf":[{"type":"object","allOf":[{"type":"object","properties":{"type":{"type":"string","enum":["agent"]}}},{"$ref":"#/components/schemas/Agent"}],"required":["type"]},{"type":"object","allOf":[{"type":"object","properties":{"type":{"type":"string","enum":["agent_summary"]}}},{"$ref":"#/components/schemas/AgentSummary"}],"required":["type"]},{"type":"object","allOf":[{"type":"object","properties":{"type":{"type":"string","enum":["group_summary"]}}},{"$ref":"#/components/schemas/GroupSummary"}],"required":["type"]},{"type":"object","allOf":[{"type":"object","properties":{"type":{"type":"string","enum":["schedule_summary"]}}},{"$ref":"#/components/schemas/ScheduleSummary"}],"required":["type"]}],"description":"The actor object either relates gives a summary of an actor in an escalation policy or gives full details of an actor. This depends on the capabilities of the ticketing provider. An actor is someone or something that will be notified when certain conditions are met. It can either be an agent, a group, or a schedule.","x-fern-availability":"deprecated"}},"components/schemas/EscalationPolicy":{"id":"components/schemas/EscalationPolicy","kind":"json-schema","title":"EscalationPolicy","data":{"title":"EscalationPolicy","type":"object","description":"The escalation policy object describes an escalation policy for a ticket. It contains an id for the escalation policy, an optional name, an optional description, and a list of rules.","properties":{"id":{"$ref":"#/components/schemas/Id"},"name":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"rules":{"type":"array","items":{"$ref":"#/components/schemas/EscalationPolicyRule"}},"unmapped":{"$ref":"#/components/schemas/Object","nullable":true,"description":"The attributes that are not mapped to the comment schema. The names and values of those attributes are specific to the provider."}},"required":["id","rules"],"x-fern-availability":"deprecated"}},"components/schemas/EscalationPolicyRule":{"id":"components/schemas/EscalationPolicyRule","kind":"json-schema","title":"EscalationPolicyRule","data":{"title":"EscalationPolicyRule","type":"object","description":"The escalation policy rule object describes a rule for an escalation policy. It contains an optional id for the rule, a delay in seconds before the next actor is notified, and a list of actors.","properties":{"id":{"$ref":"#/components/schemas/Id","nullable":true},"delay_seconds":{"type":"integer"},"actors":{"type":"array","items":{"$ref":"#/components/schemas/Actor"}},"unmapped":{"$ref":"#/components/schemas/Object","nullable":true,"description":"The attributes that are not mapped to the comment schema. The names and values of those attributes are specific to the provider."}},"required":["delay_seconds","actors"],"x-fern-availability":"deprecated"}},"components/schemas/CreateTicketRequest":{"id":"components/schemas/CreateTicketRequest","kind":"json-schema","title":"CreateTicketRequest","data":{"title":"CreateTicketRequest","type":"object","properties":{"summary":{"type":"string","nullable":true,"description":"Ticket summary."},"creator":{"type":"string","nullable":true,"description":"User who created this ticket."},"assignee":{"type":"string","nullable":true,"description":"Who ticket is assigned to."},"contact":{"type":"string","nullable":true,"description":"Ticket contact information."},"description":{"type":"string","nullable":true,"description":"Ticket description."},"priority":{"$ref":"#/components/schemas/Priority","nullable":true,"description":"The priority of the Ticket"},"due_date":{"type":"string","format":"date-time","nullable":true,"description":"The ticket's due date."},"completion_date":{"type":"string","format":"date-time","nullable":true,"description":"The ticket's complete date."},"status":{"$ref":"#/components/schemas/Status","nullable":true,"description":"The current status of the ticket."},"project":{"type":"string","nullable":true,"description":"The ticket project."},"issue_type":{"type":"string","nullable":true,"description":"The ticket's type."},"parent":{"type":"string","nullable":true,"description":"Provider specific ID of the parent ticket."},"tags":{"type":"array","items":{"type":"string"},"nullable":true,"description":"Associate tags with Ticket"},"custom_fields":{"type":"object","additionalProperties":true,"nullable":true,"description":"Set custom fields for this ticket, keys are the custom field names."}},"allOf":[{"$ref":"#/components/schemas/BaseResourceRequest"}]}},"components/schemas/CreateAttachmentRequest":{"id":"components/schemas/CreateAttachmentRequest","kind":"json-schema","title":"CreateAttachmentRequest","data":{"title":"CreateAttachmentRequest","type":"object","properties":{"file_name":{"type":"string","description":"The name of the file."},"content":{"type":"string","format":"byte","description":"File contents"}},"required":["file_name","content"]}},"components/schemas/QueryTicketsResponse":{"id":"components/schemas/QueryTicketsResponse","kind":"json-schema","title":"QueryTicketsResponse","data":{"title":"QueryTicketsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/Ticket"},"description":"list of results"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/CreateCommentRequest":{"id":"components/schemas/CreateCommentRequest","kind":"json-schema","title":"CreateCommentRequest","data":{"title":"CreateCommentRequest","type":"object","properties":{"creator":{"type":"string","nullable":true,"description":"Email address of user who created this ticket. Required by PagerDuty. Not supported by Jira, ServiceNow, or Torq."},"content":{"type":"string","description":"The content of the comment."}},"required":["content"]}},"components/schemas/CreateTicketResponse":{"id":"components/schemas/CreateTicketResponse","kind":"json-schema","title":"CreateTicketResponse","data":{"title":"CreateTicketResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/Ticket"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/GetTicketResponse":{"id":"components/schemas/GetTicketResponse","kind":"json-schema","title":"GetTicketResponse","data":{"title":"GetTicketResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/Ticket"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/ListProjectsResponse":{"id":"components/schemas/ListProjectsResponse","kind":"json-schema","title":"ListProjectsResponse","data":{"title":"ListProjectsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/Project"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/PatchTicketResponse":{"id":"components/schemas/PatchTicketResponse","kind":"json-schema","title":"PatchTicketResponse","data":{"title":"PatchTicketResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/Ticket"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/CreateAttachmentResponse":{"id":"components/schemas/CreateAttachmentResponse","kind":"json-schema","title":"CreateAttachmentResponse","data":{"title":"CreateAttachmentResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/AttachmentMetadata"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/ListAttachmentsMetadataResponse":{"id":"components/schemas/ListAttachmentsMetadataResponse","kind":"json-schema","title":"ListAttachmentsMetadataResponse","data":{"title":"ListAttachmentsMetadataResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/AttachmentMetadata"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/DownloadAttachmentResponse":{"id":"components/schemas/DownloadAttachmentResponse","kind":"json-schema","title":"DownloadAttachmentResponse","data":{"title":"DownloadAttachmentResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/Attachment"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/ListRemoteFieldsResponse":{"id":"components/schemas/ListRemoteFieldsResponse","kind":"json-schema","title":"ListRemoteFieldsResponse","data":{"title":"ListRemoteFieldsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/RemoteField"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/ListIssueTypesResponse":{"id":"components/schemas/ListIssueTypesResponse","kind":"json-schema","title":"ListIssueTypesResponse","data":{"title":"ListIssueTypesResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/IssueType"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}],"x-fern-availability":"in-development"}},"components/schemas/ListCommentsResponse":{"id":"components/schemas/ListCommentsResponse","kind":"json-schema","title":"ListCommentsResponse","data":{"title":"ListCommentsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/Comment"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/CreateCommentResponse":{"id":"components/schemas/CreateCommentResponse","kind":"json-schema","title":"CreateCommentResponse","data":{"title":"CreateCommentResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/Comment"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/PatchNoteResponse":{"id":"components/schemas/PatchNoteResponse","kind":"json-schema","title":"PatchNoteResponse","data":{"title":"PatchNoteResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/Note"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/QueryEscalationPoliciesResponse":{"id":"components/schemas/QueryEscalationPoliciesResponse","kind":"json-schema","title":"QueryEscalationPoliciesResponse","data":{"title":"QueryEscalationPoliciesResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/EscalationPolicy"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}],"x-fern-availability":"deprecated"}},"components/schemas/ListOnCallResponse":{"id":"components/schemas/ListOnCallResponse","kind":"json-schema","title":"ListOnCallResponse","data":{"title":"ListOnCallResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/Agent"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}],"x-fern-availability":"deprecated"}},"components/schemas/NoteId":{"id":"components/schemas/NoteId","kind":"json-schema","title":"Id","data":{"title":"Id","type":"string"}},"components/schemas/Note":{"id":"components/schemas/Note","kind":"json-schema","title":"Note","data":{"title":"Note","type":"object","description":"Note on a ticket","properties":{"id":{"$ref":"#/components/schemas/NoteId"},"ticket_id":{"$ref":"#/components/schemas/TicketId"},"content":{"type":"string","description":"The content of the note formatted as markdown."},"creator":{"type":"string","description":"The user who created the note."},"title":{"type":"string","description":"The title of the note."},"created_at":{"type":"string","format":"date-time","description":"The date the comment was created."},"updated_at":{"type":"string","format":"date-time","nullable":true,"description":"The date the comment was last updated."},"custom_fields":{"type":"object","additionalProperties":true,"nullable":true,"description":"Custom mapped fields for this note."},"unmapped":{"$ref":"#/components/schemas/Object","nullable":true,"description":"The attributes that are not mapped to the comment schema. The names and values of those attributes are specific to the provider."}},"required":["id","ticket_id","content","creator","title","created_at"]}},"components/schemas/CreateNoteRequest":{"id":"components/schemas/CreateNoteRequest","kind":"json-schema","title":"CreateNoteRequest","data":{"title":"CreateNoteRequest","type":"object","properties":{"content":{"type":"string","description":"The content of the note formatted as markdown."},"title":{"type":"string","description":"The title of the note."}},"required":["content","title"]}},"components/schemas/CreateNoteResponse":{"id":"components/schemas/CreateNoteResponse","kind":"json-schema","title":"CreateNoteResponse","data":{"title":"CreateNoteResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/Note"}},"required":["result"]}},"components/schemas/ListNotesResponse":{"id":"components/schemas/ListNotesResponse","kind":"json-schema","title":"ListNotesResponse","data":{"title":"ListNotesResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/Note"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/CreateAssetStatus":{"id":"components/schemas/CreateAssetStatus","kind":"json-schema","title":"CreateAssetStatus","data":{"title":"CreateAssetStatus","type":"string","enum":["Unknown","Pending","Complete"]}},"components/schemas/UploadScanStatus":{"id":"components/schemas/UploadScanStatus","kind":"json-schema","title":"UploadScanStatus","data":{"title":"UploadScanStatus","type":"string","enum":["Unknown","Pending","Complete","Error"]}},"components/schemas/SecurityFinding":{"id":"components/schemas/SecurityFinding","kind":"json-schema","title":"ocsfv1.3.0securityfindingSecurityFinding","data":{"title":"ocsfv1.3.0securityfindingSecurityFinding","type":"object","description":"Security Finding events describe findings, detections, anomalies, alerts and/or actions performed by security products","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"analytic":{"$ref":"#/components/schemas/ocsfv1.3.0Analytic","nullable":true,"description":"The analytic technique used to analyze and derive insights from the data or information that led to the finding or conclusion."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The attack object describes the technique and associated tactics as defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://attack.mitre.org/wiki/ATT&CK_Matrix"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"ATT&CK Matrix"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"sup","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"TM"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingCategoryUid","description":"The category unique identifier of the event."},"cis_csc":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0CisCsc"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The CIS Critical Security Controls is a list of top 20 actions and practices an organization’s security team can take on such that cyber attacks or malware, are minimized and prevented."},"children":[],"type":"text"}],"type":"paragraph"}]},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"compliance":{"$ref":"#/components/schemas/ocsfv1.3.0Compliance","nullable":true,"description":"The compliance object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS, NIST etc.) and contains compliance related details."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"data_sources":{"type":"array","items":{"type":"string"},"nullable":true,"description":"A list of data sources utilized in generation of the finding."},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the affected device/host. It can be used in conjunction with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Affected Resource(s)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. Specific details about an AWS EC2 instance, that is affected by the Finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"evidence":{"nullable":true,"description":"The data the finding exposes to the analyst."},"finding":{"$ref":"#/components/schemas/ocsfv1.3.0Finding","description":"The Finding object provides details about a finding/detection generated by a security tool."},"impact":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"impact_id":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingImpactId","nullable":true,"description":"The normalized impact of the finding."},"impact_score":{"type":"integer","nullable":true,"description":"The impact of the finding, valid range 0-100."},"kill_chain":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0KillChainPhase"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"a","attrs":{"target":"_blank","href":"https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html"}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Cyber Kill Chain®"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" provides a detailed description of each phase and its associated activities within the broader context of a cyber attack."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"nist":{"type":"array","items":{"type":"string"},"nullable":true,"description":"The NIST Cybersecurity Framework recommendations for managing the cybersecurity risk."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"process":{"$ref":"#/components/schemas/ocsfv1.3.0Process","nullable":true,"description":"The process object."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0ResourceDetails"},"nullable":true,"description":"Describes details about resources that were affected by the activity/event."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"state":{"type":"string","nullable":true,"description":"The normalized state of a security finding."},"state_id":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingStateId","description":"The normalized state identifier of a security finding."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"vulnerabilities":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Vulnerability"},"nullable":true,"description":"This object describes vulnerabilities reported in a security finding."}},"required":["activity_id","category_uid","class_uid","finding","metadata","severity_id","state_id","time","type_uid"]}},"components/schemas/Asset":{"id":"components/schemas/Asset","kind":"json-schema","title":"ocsfv1.3.0inventoryinfoInventoryInfo","data":{"title":"ocsfv1.3.0inventoryinfoInventoryInfo","type":"object","description":"Device Inventory Info events report device inventory data that is either logged or proactively collected. For example, when collecting device information from a CMDB or running a network sweep of connected devices.","properties":{"activity_id":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoActivityId","description":"The normalized identifier of the activity that triggered the event."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event activity name, as defined by the activity_id."},"children":[],"type":"text"}],"type":"paragraph"}]},"actor":{"$ref":"#/components/schemas/ocsfv1.3.0Actor","nullable":true,"description":"The actor object describes details about the user/role/process that was the source of the activity."},"api":{"$ref":"#/components/schemas/ocsfv1.3.0Api","nullable":true,"description":"Describes details about a typical API (Application Programming Interface) call."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Discovery"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"cloud":{"$ref":"#/components/schemas/ocsfv1.3.0Cloud","nullable":true,"description":"Describes details about the Cloud environment where the event was originally created or logged."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"custom_fields":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"A list of custom fields"},"device":{"$ref":"#/components/schemas/ocsfv1.3.0Device","description":"The device that is being discovered by an inventory process."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The end time of a time period, or the time of the most recent event included in the aggregate event."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.3.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"osint":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0Osint"},"nullable":true,"description":"The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The start time of a time period, or the time of the least recent event included in the aggregate event."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoStatusId","nullable":true,"description":"The normalized identifier of the event status."},"time":{"$ref":"#/components/schemas/ocsfv1.3.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.3.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."}},"required":["activity_id","category_uid","class_uid","device","metadata","severity_id","time","type_uid"]}},"components/schemas/VulnerabilitiesFinding":{"id":"components/schemas/VulnerabilitiesFinding","kind":"json-schema","title":"ocsfv1.8.0vulnerabilityfindingVulnerabilityFinding","data":{"title":"ocsfv1.8.0vulnerabilityfindingVulnerabilityFinding","type":"object","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Vulnerability Finding event is a notification about weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source. Note: if the event producer is a security control, the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"security_control"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile should be applied and its "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"attacks"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" information, if present, should be duplicated into the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"finding_info"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" object. "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Note: "},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"If the Finding is an incident, i.e. requires incident workflow, also apply the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"incident"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" profile  or aggregate this finding into an "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Incident Finding"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}],"properties":{"action":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized caption of "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"action_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"action_id":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingActionId","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The action taken by a control or other policy-based system leading to an outcome or disposition. An unknown action may still correspond to a known disposition. Refer to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" for the outcome of the action."},"children":[],"type":"text"}],"type":"paragraph"}]},"activity_id":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingActivityId","description":"The normalized identifier of the finding activity."},"activity_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The finding activity name, as defined by the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"attacks":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Attack"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"An array of MITRE ATT&CK® objects describing identified tactics, techniques & sub-techniques. The objects are compatible with MITRE ATLAS™ tactics, techniques & sub-techniques."},"children":[],"type":"text"}],"type":"paragraph"}]},"authorizations":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Authorization"},"nullable":true,"description":"Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event."},"category_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event category name, as defined by category_uid value: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Findings"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"category_uid":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingCategoryUid","description":"The category unique identifier of the event."},"class_uid":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingClassUid","description":"The unique identifier of a class. A class describes the attributes available in an event."},"comment":{"type":"string","nullable":true,"description":"A user provided comment about the finding."},"confidence":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"confidence_id":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingConfidenceId","nullable":true,"description":"The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature."},"confidence_score":{"type":"integer","nullable":true,"description":"The confidence score as reported by the event source."},"count":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of times that events in the same logical group occurred during the event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Start Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"strong","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"End Time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"device":{"$ref":"#/components/schemas/ocsfv1.8.0Device","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Describes the affected device/host. If applicable, it can be used in conjunction with "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Resource(s)"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":". "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":" e.g. Specific details about an AWS EC2 instance, that is affected by the Finding."},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"disposition":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source."},"children":[],"type":"text"}],"type":"paragraph"}]},"disposition_id":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingDispositionId","nullable":true,"description":"Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations."},"duration":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event duration or aggregate time, the amount of time the event covers from "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"start_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"end_time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" in milliseconds."},"children":[],"type":"text"}],"type":"paragraph"}]},"end_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the most recent event included in the finding."},"end_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the most recent event included in the finding."},"enrichments":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Enrichment"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:"},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"p","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]"},"children":[],"type":"text"}],"type":"tag","tag":"html"}],"type":"paragraph"}]},"finding_info":{"$ref":"#/components/schemas/ocsfv1.8.0FindingInfo","description":"Describes the supporting information about a generated finding."},"firewall_rule":{"$ref":"#/components/schemas/ocsfv1.8.0FirewallRule","nullable":true,"description":"The firewall rule that pertains to the control that triggered the event, if applicable."},"is_alert":{"type":"boolean","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Indicates that the event is considered to be an alertable signal. Should be set to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"true"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Alert"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" among other dispositions, and/or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"risk_level_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" of the event is elevated. Not all control events will be alertable, for example if "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Exonerated"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"disposition_id = Allowed"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"malware":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Malware"},"nullable":true,"description":"A list of Malware objects, describing details about the identified malware."},"malware_scan_info":{"$ref":"#/components/schemas/ocsfv1.8.0MalwareScanInfo","nullable":true,"description":"Describes details about the scan job that identified malware on the target system."},"message":{"type":"string","nullable":true,"description":"The description of the event/finding, as defined by the source."},"metadata":{"$ref":"#/components/schemas/ocsfv1.8.0Metadata","description":"The metadata associated with the event or a finding."},"observables":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Observable"},"nullable":true,"description":"The observables associated with the event or a finding."},"policy":{"$ref":"#/components/schemas/ocsfv1.8.0Policy","nullable":true,"description":"The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."},"raw_data":{"type":"string","nullable":true,"description":"The raw event/finding data as received from the source."},"raw_data_hash":{"$ref":"#/components/schemas/ocsfv1.8.0Fingerprint","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The hash, which describes the content of the raw_data field."},"children":[],"type":"text"}],"type":"paragraph"}]},"raw_data_size":{"type":"integer","nullable":true,"description":"The size of the raw data which was transformed into an OCSF event, in bytes."},"resource":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails","nullable":true,"description":"Describes details about the resource that is affected by the vulnerability/vulnerabilities."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0ResourceDetails"},"nullable":true,"description":"Describes details about the resource/resources that are affected by the vulnerability/vulnerabilities."},"risk_details":{"type":"string","nullable":true,"description":"Describes the risk associated with the finding."},"risk_level":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The risk level, normalized to the caption of the risk_level_id value."},"children":[],"type":"text"}],"type":"paragraph"}]},"risk_level_id":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingRiskLevelId","nullable":true,"description":"The normalized risk level id."},"risk_score":{"type":"integer","nullable":true,"description":"The risk score as reported by the event source."},"severity":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding severity, normalized to the caption of the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"severity_id":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingSeverityId","description":[{"$$mdtype":"Node","attributes":{"name":"p","attrs":{}},"children":[{"$$mdtype":"Node","attributes":{"content":"The normalized identifier of the event/finding severity."},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","attributes":{"content":"The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events."},"children":[],"type":"text"}]},"start_time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","nullable":true,"description":"The time of the least recent event included in the finding."},"start_time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The time of the least recent event included in the finding."},"status":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_code":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event status code, as reported by the event source."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18."},"children":[],"type":"text"}],"type":"paragraph"}]},"status_detail":{"type":"string","nullable":true,"description":"The status detail contains additional information about the event/finding outcome."},"status_id":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingStatusId","nullable":true,"description":"The normalized status identifier of the Finding, set by the consumer."},"time":{"$ref":"#/components/schemas/ocsfv1.8.0Timestamp","description":"The normalized event occurrence time or the finding creation time."},"time_dt":{"type":"string","format":"date-time","nullable":true,"description":"The normalized event occurrence time or the finding creation time."},"timezone_offset":{"type":"integer","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The number of minutes that the reported event "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"time"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" is ahead or behind UTC, in the range -1,080 to +1,080."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type name, as defined by the type_uid."},"children":[],"type":"text"}],"type":"paragraph"}]},"type_uid":{"$ref":"#/components/schemas/ocsfv1.8.0vulnerabilityfindingTypeUid","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"class_uid * 100 + activity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"unmapped":{"$ref":"#/components/schemas/ocsfv1.8.0Object","nullable":true,"description":"The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source."},"vendor_attributes":{"$ref":"#/components/schemas/ocsfv1.8.0VendorAttributes","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The Vendor Attributes object can be used to represent values of attributes populated by the Vendor/Finding Provider. It can help distinguish between the vendor-provided values and consumer-updated values, of key attributes like "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"code","attrs":{}},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity_id"},"children":[],"type":"text"}],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"name":"br","attrs":{}},"children":[],"type":"tag","tag":"html"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"The original finding producer should not populate this object. It should be populated by consuming systems that support data mutability."},"children":[],"type":"text"}],"type":"paragraph"}]},"vulnerabilities":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.8.0Vulnerability"},"description":"This object describes vulnerabilities reported in a security finding."}},"required":["activity_id","category_uid","class_uid","finding_info","metadata","severity_id","time","type_uid","vulnerabilities"]}},"components/schemas/QueryFindingsResponse":{"id":"components/schemas/QueryFindingsResponse","kind":"json-schema","title":"QueryFindingsResponse","data":{"title":"QueryFindingsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/SecurityFinding"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"},{"$ref":"#/components/schemas/APIHasStatus"}]}},"components/schemas/CreateFindingsRequest":{"id":"components/schemas/CreateFindingsRequest","kind":"json-schema","title":"CreateFindingsRequest","data":{"title":"CreateFindingsRequest","type":"object","properties":{"findings":{"type":"array","items":{"$ref":"#/components/schemas/SecurityFinding"}}},"required":["findings"]}},"components/schemas/CreateFindingsResponse":{"id":"components/schemas/CreateFindingsResponse","kind":"json-schema","title":"CreateFindingsResponse","data":{"title":"CreateFindingsResponse","type":"object","properties":{"status":{"$ref":"#/components/schemas/QueryStatus","description":"Specifies the status of the create/import findings job, which can be COMPLETE or PENDING."},"errors":{"type":"array","items":{"$ref":"#/components/schemas/CreateFindingsError"},"nullable":true,"description":"Provides additional details about any errors encountered during the create/import operation."}},"required":["status"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/CreateFindingsError":{"id":"components/schemas/CreateFindingsError","kind":"json-schema","title":"CreateFindingsError","data":{"title":"CreateFindingsError","type":"object","properties":{"message":{"type":"string","description":"A descriptive error message providing more information about the issue."}},"required":["message"]}},"components/schemas/UpdateFindingRequest":{"id":"components/schemas/UpdateFindingRequest","kind":"json-schema","title":"UpdateFindingRequest","data":{"title":"UpdateFindingRequest","type":"object","properties":{"severity_id":{"$ref":"#/components/schemas/ocsfv1.3.0securityfindingSeverityId"},"severity":{"$ref":"#/components/schemas/VulnerabilitySeverityFilterValue","nullable":true,"description":"severity of the finding"},"state":{"$ref":"#/components/schemas/VulnerabilityStateFilterValue","nullable":true,"description":"state of the finding"},"unmapped":{"$ref":"#/components/schemas/ProviderSpecificFindingState","nullable":true}},"required":["severity_id"]}},"components/schemas/VulnerabilityStateFilterValue":{"id":"components/schemas/VulnerabilityStateFilterValue","kind":"json-schema","title":"VulnerabilityStateFilterValue","data":{"title":"VulnerabilityStateFilterValue","type":"string","enum":["Unknown","New","InProgress","Resolved","Other"],"description":"The normalized state identifier of a security finding"}},"components/schemas/ProviderSpecificFindingState":{"id":"components/schemas/ProviderSpecificFindingState","kind":"json-schema","title":"ProviderSpecificFindingState","data":{"title":"ProviderSpecificFindingState","oneOf":[{"type":"object","allOf":[{"type":"object","properties":{"type":{"type":"string","enum":["nucleus"]}}},{"$ref":"#/components/schemas/NucleusFindingState"}],"required":["type"]}]}},"components/schemas/NucleusFindingState":{"id":"components/schemas/NucleusFindingState","kind":"json-schema","title":"NucleusFindingState","data":{"title":"NucleusFindingState","type":"object","properties":{"due_date":{"type":"string","format":"date-time","nullable":true,"description":"Due date for the finding."},"comment":{"type":"string","nullable":true,"description":"Comment to add to the finding."}}}},"components/schemas/QueryAssetsResponse":{"id":"components/schemas/QueryAssetsResponse","kind":"json-schema","title":"QueryAssetsResponse","data":{"title":"QueryAssetsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/Asset"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"},{"$ref":"#/components/schemas/APIHasStatus"}]}},"components/schemas/CreateAssetRequest":{"id":"components/schemas/CreateAssetRequest","kind":"json-schema","title":"CreateAssetRequest","data":{"title":"CreateAssetRequest","type":"object","properties":{"asset":{"$ref":"#/components/schemas/Asset","description":"Asset to create in the vulnerability scanning system."},"source_name":{"type":"string","description":"Name of the source that created the asset."}},"required":["asset","source_name"]}},"components/schemas/CreateAssetResponse":{"id":"components/schemas/CreateAssetResponse","kind":"json-schema","title":"CreateAssetResponse","data":{"title":"CreateAssetResponse","type":"object","properties":{"device":{"$ref":"#/components/schemas/CreateAssetDevice","description":"Created device."}},"required":["device"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/CreateAssetDevice":{"id":"components/schemas/CreateAssetDevice","kind":"json-schema","title":"CreateAssetDevice","data":{"title":"CreateAssetDevice","type":"object","properties":{"uid":{"type":"string","nullable":true,"description":"ID of the device."},"status":{"$ref":"#/components/schemas/CreateAssetStatus","description":"Status of the creation of the asset in the providers system."}},"required":["status"]}},"components/schemas/VulnerabilitySeverityFilterValue":{"id":"components/schemas/VulnerabilitySeverityFilterValue","kind":"json-schema","title":"VulnerabilitySeverityFilterValue","data":{"title":"VulnerabilitySeverityFilterValue","type":"string","enum":["critical","high","medium","low","info"],"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Values supported by using severity as a filter. Supports "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[eq]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[in]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" operators. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity[eq]critical"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"severity[in]critical, high"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"components/schemas/QueryScansResponse":{"id":"components/schemas/QueryScansResponse","kind":"json-schema","title":"QueryScansResponse","data":{"title":"QueryScansResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ScanConfiguration"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/UploadScanRequest":{"id":"components/schemas/UploadScanRequest","kind":"json-schema","title":"UploadScanRequest","data":{"title":"UploadScanRequest","type":"object","properties":{"assets":{"type":"array","items":{"$ref":"#/components/schemas/Asset"},"description":"Assets and optional findings to upload in the vulnerability scanning system."},"source_name":{"type":"string","nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Name of the source for this scan, such as a tool or process. Does not have to be unique, defaults to "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"Integration import"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["assets"]}},"components/schemas/UploadScanResponse":{"id":"components/schemas/UploadScanResponse","kind":"json-schema","title":"UploadScanResponse","data":{"title":"UploadScanResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/ScanStatus"},"errors":{"$ref":"#/components/schemas/Problem","nullable":true,"description":"Provides additional details about any errors encountered during the upload scan operation."}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/GetScanStatusResponse":{"id":"components/schemas/GetScanStatusResponse","kind":"json-schema","title":"GetScanStatusResponse","data":{"title":"GetScanStatusResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/ScanStatus"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/VulnerabilitiesQueryScanFindingsResponse":{"id":"components/schemas/VulnerabilitiesQueryScanFindingsResponse","kind":"json-schema","title":"VulnerabilitiesQueryScanFindingsResponse","data":{"title":"VulnerabilitiesQueryScanFindingsResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/VulnerabilitiesFinding"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIQueryResponse"}]}},"components/schemas/ScanStatus":{"id":"components/schemas/ScanStatus","kind":"json-schema","title":"ScanStatus","data":{"title":"ScanStatus","type":"object","properties":{"scan_id":{"type":"string","description":"ID of the scan."},"status":{"$ref":"#/components/schemas/UploadScanStatus","description":"Specifies the status of the scan, which can be Complete, Pending, or Error."},"message":{"type":"string","nullable":true,"description":"Provider specific status message for this scan."}},"required":["scan_id","status"]}},"components/schemas/ScanConfiguration":{"id":"components/schemas/ScanConfiguration","kind":"json-schema","title":"ScanConfiguration","data":{"title":"ScanConfiguration","type":"object","description":"Configuration options of a scan.","properties":{"uid":{"type":"string","description":"ID of the scan."},"name":{"type":"string","description":"Name of the scan."},"creation_time":{"type":"integer","nullable":true,"description":"Time when the scan was created."},"last_modified_time":{"type":"integer","nullable":true,"description":"Time when the scan was last modified."},"owner":{"$ref":"#/components/schemas/User","nullable":true,"description":"User that owns the scan."},"schedule":{"$ref":"#/components/schemas/ScanSchedule","nullable":true,"description":"Schedule of the scan if it is a recurring scan."}},"required":["uid","name"]}},"components/schemas/User":{"id":"components/schemas/User","kind":"json-schema","title":"User","data":{"title":"User","type":"object","properties":{"uid":{"type":"string","description":"ID of the user."}},"required":["uid"]}},"components/schemas/GetScanActivityResponse":{"id":"components/schemas/GetScanActivityResponse","kind":"json-schema","title":"GetScanActivityResponse","data":{"title":"GetScanActivityResponse","type":"object","properties":{"result":{"$ref":"#/components/schemas/ocsfv1.3.0scanactivityScanActivity"}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/GetScanActivitiesResponse":{"id":"components/schemas/GetScanActivitiesResponse","kind":"json-schema","title":"GetScanActivitiesResponse","data":{"title":"GetScanActivitiesResponse","type":"object","properties":{"result":{"type":"array","items":{"$ref":"#/components/schemas/ocsfv1.3.0scanactivityScanActivity"}}},"required":["result"],"allOf":[{"$ref":"#/components/schemas/APIResponse"}]}},"components/schemas/ScanSchedule":{"id":"components/schemas/ScanSchedule","kind":"json-schema","title":"ScanSchedule","data":{"title":"ScanSchedule","type":"object","properties":{"time":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Time of the day when the scan are repeated. For scans that are executed once, this is the time when the scan was started. This is formatted as "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"HH:MM:SS"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]},"frequency":{"$ref":"#/components/schemas/ScanFrequencyOption","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Periodicity of the scan; for example, weekly, means that the scan will be repeated every "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"repeat_interval"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" weeks."},"children":[],"type":"text"}],"type":"paragraph"}]},"repeat_interval":{"type":"integer","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Number of days, weeks, months, or years between scans. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"1"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" means that the scan will be repeated once every "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"frequency"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" period."},"children":[],"type":"text"}],"type":"paragraph"}]},"days":{"type":"array","items":{"type":"string"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Days of the week when the scan will be repeated. For example, "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"[\"monday\", \"friday\"]"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" means that the scan will be repeated on Monday and Friday on the schedule defined by "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"frequency"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" and "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"repeat_interval"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["time","frequency","repeat_interval"]}},"components/schemas/ScanFrequencyOption":{"id":"components/schemas/ScanFrequencyOption","kind":"json-schema","title":"ScanFrequencyOption","data":{"title":"ScanFrequencyOption","type":"string","enum":["once","daily","weekly","monthly","yearly","unknown"]}},"schema_0":{"kind":"json-schema","data":{"type":"array","items":{"type":"string","nullable":true}},"id":"schema_0"},"schema_1":{"kind":"json-schema","data":{"type":"integer","nullable":true},"id":"schema_1"},"schema_2":{"kind":"json-schema","data":{"type":"string","nullable":true},"id":"schema_2"},"schema_3":{"kind":"json-schema","data":{"type":"boolean","nullable":true},"id":"schema_3"},"schema_4":{"kind":"json-schema","data":{"$ref":"#/components/schemas/ApplicationId"},"id":"schema_4"},"schema_5":{"kind":"json-schema","data":{"title":"ApplicationId","$ref":"#/components/schemas/Id","description":"The unique identifier of the application"},"id":"schema_5"},"schema_6":{"kind":"json-schema","data":{"type":"array","items":{"$ref":"#/components/schemas/AppSecPostureFinding"}},"id":"schema_6"},"schema_7":{"kind":"json-schema","data":{"$ref":"#/components/schemas/FindingId"},"id":"schema_7"},"schema_8":{"kind":"json-schema","data":{"title":"FindingId","$ref":"#/components/schemas/Id","description":"The unique identifier of the finding"},"id":"schema_8"},"schema_9":{"kind":"json-schema","data":{"type":"string"},"id":"schema_9"},"schema_10":{"kind":"json-schema","data":{"type":"object","properties":{"message":{"type":"string","description":"The plain-text content of the message."},"parent_uid":{"type":"string","nullable":true,"description":"UID of the top-level message to reply to, which starts or continues its thread. Omit to post a new top-level message."},"mentions":{"type":"array","items":{"$ref":"#/components/schemas/UserReference"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Users to mention, at most 20. Each is notified and named once at the start of the message, in the provider's own mention format, which "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" then includes in the response and in reads."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["message"]},"id":"schema_10"},"schema_11":{"kind":"json-schema","data":{"type":"object","properties":{"user":{"$ref":"#/components/schemas/UserReference","description":"The user to message."},"message":{"type":"string","description":"The plain-text content of the message."}},"required":["user","message"]},"id":"schema_11"},"schema_12":{"kind":"json-schema","data":{"type":"object","properties":{"message":{"type":"string","description":"The new plain-text content of the message."},"mentions":{"type":"array","items":{"$ref":"#/components/schemas/UserReference"},"nullable":true,"description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Users to mention, at most 20. Each is notified and named once at the start of the message, in the provider's own mention format, which "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"message"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" then includes in the response and in reads."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["message"]},"id":"schema_12"},"schema_13":{"kind":"json-schema","data":{"$ref":"#/components/schemas/Id"},"id":"schema_13"},"schema_14":{"kind":"json-schema","data":{"$ref":"#/components/schemas/GrcControlId"},"id":"schema_14"},"schema_15":{"kind":"json-schema","data":{"title":"GrcControlId","$ref":"#/components/schemas/Id","description":"The unique identifier of a compliance control."},"id":"schema_15"},"schema_16":{"kind":"json-schema","data":{"$ref":"#/components/schemas/GrcTestId"},"id":"schema_16"},"schema_17":{"kind":"json-schema","data":{"title":"GrcTestId","$ref":"#/components/schemas/Id","description":"The unique identifier of a compliance test."},"id":"schema_17"},"schema_18":{"kind":"json-schema","data":{"$ref":"#/components/schemas/GrcDeviceId"},"id":"schema_18"},"schema_19":{"kind":"json-schema","data":{"title":"GrcDeviceId","$ref":"#/components/schemas/Id","description":"The unique identifier of a device tracked in the GRC platform."},"id":"schema_19"},"schema_20":{"kind":"json-schema","data":{"$ref":"#/components/schemas/GrcPersonnelId"},"id":"schema_20"},"schema_21":{"kind":"json-schema","data":{"title":"GrcPersonnelId","$ref":"#/components/schemas/Id","description":"The unique identifier of a person tracked in the GRC platform."},"id":"schema_21"},"schema_22":{"kind":"json-schema","data":{},"id":"schema_22"},"schema_23":{"kind":"json-schema","data":{"$ref":"#/components/schemas/UserId"},"id":"schema_23"},"schema_24":{"kind":"json-schema","data":{"$ref":"#/components/schemas/GroupId"},"id":"schema_24"},"schema_25":{"kind":"json-schema","data":{"$ref":"#/components/schemas/NotificationId"},"id":"schema_25"},"schema_26":{"kind":"json-schema","data":{"title":"NotificationId","$ref":"#/components/schemas/Id","description":"Unique identifier for this notification"},"id":"schema_26"},"schema_27":{"kind":"json-schema","data":{"$ref":"#/components/schemas/AsyncOperationRequestId"},"id":"schema_27"},"schema_28":{"kind":"json-schema","data":{"title":"AsyncOperationRequestId","$ref":"#/components/schemas/Id","description":"Unique request identifier for this Asynchronous Operation."},"id":"schema_28"},"schema_29":{"kind":"json-schema","data":{"type":"array","items":{"$ref":"#/components/schemas/Event"}},"id":"schema_29"},"schema_30":{"kind":"json-schema","data":{"type":"object","properties":{"file":{"type":"string","format":"binary"}}},"id":"schema_30"},"schema_31":{"kind":"json-schema","data":{"type":"string","format":"binary"},"id":"schema_31"},"schema_32":{"kind":"json-schema","data":{"type":"object","properties":{"value":{"type":"string","description":"The file hash to look up (MD5, SHA-1, or SHA-256, hex-encoded)."}},"required":["value"]},"id":"schema_32"},"schema_33":{"kind":"json-schema","data":{"type":"object","properties":{"value":{"type":"string","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"The URL to look up. Must be absolute and use the "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"http"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" or "},"children":[],"type":"text"},{"$$mdtype":"Node","inline":true,"attributes":{"content":"https"},"children":[],"type":"code"},{"$$mdtype":"Node","inline":true,"attributes":{"content":" scheme."},"children":[],"type":"text"}],"type":"paragraph"}]}},"required":["value"]},"id":"schema_33"},"schema_34":{"kind":"json-schema","data":{"type":"object","properties":{"value":{"type":"string","description":"The domain name to look up. Internationalized domain names must be in punycode (A-label) form."}},"required":["value"]},"id":"schema_34"},"schema_35":{"kind":"json-schema","data":{"type":"object","properties":{"value":{"type":"string","description":"The IPv4 or IPv6 address to look up."}},"required":["value"]},"id":"schema_35"},"schema_36":{"kind":"json-schema","data":{"$ref":"#/components/schemas/ProjectId"},"id":"schema_36"},"schema_37":{"kind":"json-schema","data":{"title":"ProjectId","$ref":"#/components/schemas/Id","description":"Unique identifier for a project"},"id":"schema_37"},"schema_38":{"kind":"json-schema","data":{"$ref":"#/components/schemas/IssueTypeId"},"id":"schema_38"},"schema_39":{"kind":"json-schema","data":{"$ref":"#/components/schemas/TicketId"},"id":"schema_39"},"schema_40":{"kind":"json-schema","data":{"title":"TicketId","$ref":"#/components/schemas/Id","description":"Unique identifier for this ticket"},"id":"schema_40"},"schema_41":{"kind":"json-schema","data":{"type":"array","items":{"$ref":"#/components/schemas/PatchOperation"}},"id":"schema_41"},"schema_42":{"kind":"json-schema","data":{"$ref":"#/components/schemas/AttachmentId"},"id":"schema_42"},"schema_43":{"kind":"json-schema","data":{"title":"AttachmentId","$ref":"#/components/schemas/Id","description":"Unique identifier for an attachment"},"id":"schema_43"},"schema_44":{"kind":"json-schema","data":{"$ref":"#/components/schemas/CommentId"},"id":"schema_44"},"schema_45":{"kind":"json-schema","data":{"title":"CommentId","$ref":"#/components/schemas/Id","description":"Unique identifier for a comment"},"id":"schema_45"},"schema_46":{"kind":"json-schema","data":{"$ref":"#/components/schemas/NoteId"},"id":"schema_46"},"schema_47":{"kind":"json-schema","data":{"title":"NoteId","$ref":"#/components/schemas/Id","description":"Unique identifier for a note"},"id":"schema_47"},"schema_48":{"kind":"json-schema","data":{"title":"Asset","$ref":"#/components/schemas/ocsfv1.3.0inventoryinfoInventoryInfo","description":[{"$$mdtype":"Node","attributes":{},"children":[{"$$mdtype":"Node","inline":true,"attributes":{"content":"Asset in a vulnerability scanning system. Represented by OCSF Device Inventory Info class (class_uid 5001)."},"children":[],"type":"text"}],"type":"paragraph"}]},"id":"schema_48"}},"exampleStore":{},"securitySchemeStore":{"BearerAuth":{"id":"BearerAuth","type":"http","scheme":"bearer"}},"specVersion":"3.0.1","servers":[{"url":"https://api.synqly.com","description":"Synqly"}],"specType":"openapi"},"options":{"sanitize":true,"sortRequiredPropsFirst":true,"hideDownloadButtons":false,"hideReplay":false,"onlyRequiredInSamples":true,"codeSamples":{"skipOptionalParameters":true,"languages":[{"lang":"curl"}]},"hideOneOfDescription":true,"mockServer":{"off":true},"disableRouter":true,"downloadUrls":[{"url":"/_bundle/api-reference/connectors.json?download"},{"url":"/_bundle/api-reference/connectors.yaml?download"}],"excludeFromSearch":false,"replayFeatures":{"graphql":false,"asyncapi":false},"specType":"openapi","markdocOptions":{"tags":{},"nodes":{},"components":{}},"metadata":{"title":"Connector API","description":"The Synqly Connector APIs provide a unifying interface and data model for all supported service Providers.\n\nSee the [Synqly Overview](/guides/getting-started/overview) for more information.\n"}},"baseSlug":"/api-reference/connectors","routesMapping":{}}